Security audit

enterprise-service-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate enterprise-service purpose, but its shipped automation code can handle and mutate sensitive business data with under-scoped safeguards.

Review before installing. Do not enable scheduled sync, daemon mode, or automatic WeCom pushes until webhook allowlisting, redaction, backups, transactional sync, and pinned release installation are in place. Back up any Excel and SQLite data first.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wecom_sender.py:14
Finding: Unrestricted Webhook Destinations Can Expose Sensitive Business Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pure_sync.py:61
Finding: Synchronization Deletes Local Tables Without Inserting Retrieved Records
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/daily_check_simple.py:41
Finding: Predictable Shared Temporary File Permits Symlink-Based Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: knowledge/INSTALL.md:21
Finding: Installation Instructions Use an Unpinned Personal Git Repository
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (107)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a general-purpose园区企业服务智能助手 with broad operational coverage and specific implementation claims about SQLite-first access and Tencent Docs synchronization. The supplied code chunk instead identifies itself as a 合同续租管理技能包 and exports only contract-renewal-related modules plus reminder/WeCom messaging components. That is a materially different and much narrower primary purpose than declared, and the advertised data-source/sync behavior is not supported by this code snippet.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较完整的园区企业服务助手，重点能力包括三大业务板块、优先查询本地SQLite数据库以及定时同步腾讯文档数据。但该代码块的实际作用非常具体且更窄：它只处理若干预定义“完成”事件，向 ~/.workbuddy/.../completion_log.json 写入记录，维护 active_tasks_buffer，并生成用户提示与简单状态摘要。代码中的“刷新企业情况/更新今日工作”等多为文字层面的摘要，并没有真正连接数据库、更新外部系统或同步腾讯文档。虽然“事项跟进/今日工作”这一业务语义与声明存在部分相关性，但核心实现与声明中的关键能力和资源类型明显不符，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 该描述与代码存在实质性不一致。描述把技能定义为面向园区企业服务事务的通用智能助手，核心卖点是本地SQLite优先查询和腾讯文档定时同步；而代码实际上是一个合同续租专项管理程序，重点在合同到期预警、客户续租分类、方案生成、续租跟踪和报告输出。代码的数据来源/资源访问也与声明不符：初始化参数明确是Excel路径，并未展示SQLite查询或腾讯文档同步。与此同时，代码还调用企业微信发送通知，这是声明中未覆盖的外部通信能力。整体来看，代码的主要用途、资源访问方式和部分能力都与声明不匹配，因此应判定为mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较广泛的园区企业服务助手，强调三大业务板块、本地 SQLite 优先查询以及腾讯文档同步。但代码仅实现了合同续租场景的数据读写与统计，且数据源为 Excel 而非 SQLite，也没有任何腾讯文档同步、今日工作、事项跟进或通用企业服务助手逻辑。因此其主要用途、资源访问方式和能力范围都与声明明显不符，属于实质性描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a specific business assistant focused on park enterprise service workflows, with concrete behavior such as prioritizing a local SQLite database and supporting scheduled Tencent Docs sync. The actual code does none of this: it is a minimal placeholder script whose only behavior is printing a static example message. This is a material mismatch in primary purpose and implemented capabilities, not merely an incomplete supporting detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较完整的园区企业服务事务管理助手，强调数据查询与同步能力，以及面向多个业务板块的综合服务。实际代码则是一个非常具体的合同续租提醒消息生成模块，只负责按照模板拼接提醒内容、格式化输出和生成月度汇总文本。两者在主要用途、功能范围和资源访问能力上均存在明显差异。该代码没有任何SQLite访问、腾讯文档同步、任务管理或通用企业服务逻辑，因此属于显著描述与行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个综合型园区企业服务助手，核心能力应包括本地SQLite查询、企业服务事务管理，以及腾讯文档同步。该代码片段却只实现了合同续租场景下的企业微信消息发送，属于高度专用的通知模块。它还执行了声明中未提到的外部网络发送能力（Webhook调用）和本地配置文件读取。虽然“事项跟进”类场景可能与通知有关，但当前代码的主用途、资源访问方式和能力边界都与声明明显不符，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a functional enterprise-service assistant with specific capabilities such as local SQLite access, scheduled Tencent Docs synchronization, and management workflows. The actual code chunk is a minimal example script whose only behavior is printing a fixed string. This is a material mismatch in primary purpose and implemented capabilities, with no evidence of the described assistant behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a relatively full-featured intelligent assistant for managing park enterprise service tasks, with specific data-access behavior (SQLite-first) and scheduled Tencent Docs synchronization. The supplied code chunk is much narrower: it is a simple daily checklist validation script with hardcoded sample alerts and file output to /tmp. Its primary purpose is testing or demonstrating a minimal daily-check flow, not providing the described assistant capabilities. This is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该代码块的核心功能是对单个Excel文件中的费用收缴和客户信息进行读取、更新、关联查询及备份，属于较窄的财务/客户数据管理实现。声明则描述为一个更广泛的园区企业服务智能助手，强调优先使用本地SQLite数据库和支持腾讯文档同步。两者在数据源、功能范围和关键能力上均存在明显差异。虽然“管理园区企业服务事务”与客户/费用管理存在一定关联，但当前代码无法支撑所宣称的主要能力，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description promises a domain-specific intelligent assistant for park enterprise service management with concrete behaviors such as prioritizing local SQLite queries and supporting scheduled Tencent Docs synchronization. The actual code chunk is a minimal placeholder script that simply prints a message identifying itself as an example for fee-collection. It does not implement any assistant behavior, data access, scheduling, syncing, or enterprise-service workflows. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向园区企业服务管理的综合助手，重点能力包括今日工作、企业服务、事项跟进，以及本地SQLite查询和腾讯文档同步。给出的代码块则仅实现了一个独立的费用计算模块，没有任何数据库访问、文档同步、任务管理或企业服务流程处理逻辑。其核心职责是财务相关的逾期费用与缴费统计计算，与声明的主要用途存在明显偏离，因此属于描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a fully featured园区企业服务智能助手 focused on enterprise service management, local SQLite queries, and scheduled Tencent Docs synchronization. The actual code chunk is a minimal placeholder script named for 'inventory-monitor' that only prints a fixed message. It does not implement any of the described capabilities, access the stated resources, or align in purpose with the declared skill. This is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个面向用户的“园区企业服务智能助手”，强调通过本地SQLite查询来支持企业服务事务管理，并附带定时同步腾讯文档数据的能力。但实际代码块只包含同步侧实现：加载配置、请求腾讯文档接口、清空并同步多个SQLite表、写入sync_log，并可作为每小时运行的守护进程。代码中没有任何与“今日工作、服务企业、事项跟进”相关的查询、分析、对话或任务管理逻辑，因此其主要目的与声明的助手功能不一致。虽然“支持定时同步腾讯文档数据”这一点与声明部分一致，但这只是声明中的辅助能力，而不是完整声明的主要用途，因此应判定为描述与实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个较广义的园区企业服务助手，并特别强调本地SQLite查询和腾讯文档同步能力；而实际代码仅是一个围绕费用催缴场景的消息生成模块。它不包含数据库查询、腾讯文档同步、今日工作/服务企业/事项跟进等通用事务管理能力，主功能也明显更窄且偏向财务催缴。因此代码实际行为与声明用途存在明显不一致，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a functional园区企业服务智能助手 with specific capabilities: managing service tasks, querying a local SQLite database, and syncing Tencent Docs data on a schedule. The actual code chunk does none of these. It is a minimal example script whose only behavior is printing a placeholder message. This is a material mismatch in primary purpose and implemented capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 描述强调的是一个可用于管理园区企业服务事务的智能助手，核心体验应包括业务查询/管理能力，以及以本地SQLite为优先数据源、并可同步腾讯文档。实际提供的代码仅是 sync_to_sqlite.py，同步逻辑大多是占位符。它不会执行智能助手交互，也不实现“今日工作/服务企业/事项跟进”功能；没有任何SQLite查询逻辑；所谓腾讯文档同步也只是读取配置并打印说明，真正的数据读取被标注为 TODO，需要由外部AI/MCP工具完成。更重要的是，sync_customers 会先 DELETE FROM customers，表现为一个数据库写入/清空的维护脚本，而不是描述中的面向用户的企业服务助手。因此代码行为与声明用途存在实质性不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该描述与代码存在明显行为不一致。声明强调的是面向园区企业服务事务的智能助手，并特别指出以本地SQLite为优先数据源、支持腾讯文档同步；而实际代码是一个专门的走访管理数据管理器，核心资源是Excel文件，主要能力是读取/写入工作表、更新走访状态、统计客户走访数据和备份文件。两者在主要用途、数据存储介质和关键能力上都有实质偏差，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个具备明确业务场景和数据访问能力的智能助手，但实际代码块只是一个无实际业务逻辑的示例脚本。其主目的与声明严重不符，也没有任何与所述数据库、本地查询、同步机制或企业服务管理相关的实现。因此应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 声明描述的是一个较完整的园区企业服务事务助手，强调数据查询与同步能力，以及覆盖多个业务板块。实际代码只是一个纯本地的提醒文案生成模块：接收传入的走访/客户数据，拼接模板并返回提醒对象或文本，不进行数据库访问、外部文档同步、任务编排或综合事务管理。虽然“走访提醒”可被视为企业服务中的一个子功能，但与声明的核心能力范围和主要用途相比明显不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个较广义的园区企业服务智能助手，强调本地SQLite查询和腾讯文档同步能力；但代码仅展示走访计划管理相关逻辑，包括读取客户/走访数据、计算建议走访日期与优先级、生成提醒、更新走访状态、输出JSON日报等。代码中没有SQLite访问实现，也没有腾讯文档同步逻辑，数据访问看起来依赖Excel/DataManager而非声明所述资源。虽然“事项跟进”与企业服务场景存在一定相关性，但整体主功能与声明存在明显范围和实现方式不一致，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向园区企业服务管理的综合助手，重点能力包括本地数据库查询和腾讯文档同步；而提供的代码块是一个独立的业务评分脚本，专注于走访质量打分、统计分布和建议生成。两者在核心用途和能力范围上存在明显差异。代码没有访问数据库、没有网络/文档同步、没有任务管理或企业服务助手交互逻辑，因此应判定为描述与实际行为不符。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向园区企业服务管理的综合助手，重点能力应包括本地SQLite查询和腾讯文档同步。但提供的代码并未实现任何数据库访问、企业服务事项管理或腾讯文档同步逻辑，而是专门用于通过企业微信webhook发送消息。其具体功能集中在费用催缴、日报/月报、逾期预警和批量提醒，这与“园区企业服务智能助手”的主要用途明显不一致。此外，代码还执行了对外网络请求这一声明中未提及的能力。因此该代码块与声明用途存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims a concrete business skill with specific functional areas and data-handling behavior, especially local SQLite queries and Tencent Docs synchronization. The actual code chunk is merely a stub example script that prints a static line and performs none of the declared actions. This is a material description-behavior mismatch because the primary purpose and capabilities are absent from the code provided.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向园区企业服务管理的业务型智能助手，核心能力应围绕企业服务事务处理，并强调优先查询本地 SQLite 数据库及支持腾讯文档同步。实际代码则是 test_knowledge_base.py 测试脚本：通过命令行参数或扫描当前目录的 Excel 文件来测试 KnowledgeBase 的初始化、get_all() 和 query()，读取 knowledge_base_config.json 配置，并对 IMA/腾讯文档数据源做初始化与配置检查。其主要目的明显是验证知识库模块和数据源配置，而不是实现园区企业服务助手。资源访问上也与声明不符：代码中没有 SQLite 操作，反而以本地文件/Excel 为主要数据源测试对象；腾讯文档部分也只是配置检查，没有定时同步逻辑。因此属于明显的描述与行为不一致。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.