T09 · Insecure Skill Coding Practices
Error
- Location
converter.py:911- Finding
Spreadsheet Formula Injection in Generated Excel Workbooks
- Content
View full analysis
- Remediation
View remediation
Security audit
Bank Statement Converter
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent bank-statement conversion purpose, but its code has material safety issues when handling sensitive financial spreadsheets.
Review this before installing if you will process statements from untrusted sources or on shared machines. Use a narrow workspace folder, install dependencies in an isolated environment, avoid privileged execution, and treat generated spreadsheets as potentially unsafe until formula sanitization and safer temporary-file handling are added.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
converter.py:447- Finding
Predictable Shared Temporary File Enables Symlink and Race Attacks
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:47- Finding
Unpinned Runtime Dependency Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: xlrd== --hash=sha256: ``` Install it using hash enforcement: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` Additional hardening measures: 1. Pin all direct and transitive dependencies. 2. Generate and review hashes from a trusted package source. 3. Specify an approved package index in controlled environments. 4. Install dependencies in an isolated virtual environment rather than globally. 5. Run dependency vulnerability and provenance checks during releases. 6. Periodically update pinned versions through a documented review process. 7. Record supported Python and dependency versions to ensure reproducible deployments. ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read user-supplied folders recursively and generate converted Excel and ZIP outputs, but it does not declare any explicit tool scope or path restrictions. In an agent environment, missing permissions metadata can lead to broader-than-expected file read/write access, increasing the risk of unintended access to sensitive financial files or writing outputs outside approved workspace locations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module title and description are written entirely in Chinese and present the skill as Chinese-language only, with no indication that users can choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description is written entirely in Chinese and frames invocation/use conditions only in Chinese, with no indication that another language is supported or that the user can opt into the locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language comments and field labels are entirely Chinese, and the mapping logic is built around Chinese column names only. For a general-purpose skill, this effectively forces a specific language/locale without any visible opt-in or justification in the file.
- Content