T08 · Insecure Dependencies
Error
- Location
scripts/generate_report.py:16- Finding
Automatic Installation of Unpinned Python Dependencies at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
Finance Report Analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly generates finance reports, but it also directs use of local Feishu credentials, external file transfer, runtime package installation, and unsafe document conversion settings.
Review before installing. Use this only in an isolated environment with pinned dependencies, avoid processing untrusted spreadsheets, prefer local HTML output, and require explicit approval before any Feishu credential use, file download, report upload, or message send.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report.py:470- Finding
Unescaped Input Rendered with Weakened Browser and Local-File Security Controls
- Content
View full analysis
= 4 else h) ``` Spreadsheet values are interpolated directly into HTML: ```python if is_pct: r += f'{val_cls_open}{fmt_pct(v)}{val_cls_close}{forecast_mark}' else: fv = to_float(v) color = "" if fv is not None and not fc: color = ' class="positive"' if fv > 0 else ' class="negative"' if fv < 0 else "" elif fv is not None and fc: color = ' class="positive forecast-val"' if fv > 0 else ' class="negative forecast-val"' if fv < 0 else ' class="forecast-val"' r += f'{fmt(v)}{forecast_mark}' ``` CLI-controlled company and ticker values are inserted into the page title: ```python html = f""" {title} 财务分析报告 ``` ```python``` Generated HTML is processed with local-file access enabled or browser sandboxing disabled: ```python def html_to_pdf(html_path, pdf_path): for cmd in [ ["wkhtmltopdf", "--quiet", "--enable-local-file-access", "--page-size", "A4", "--orientation", "Landscape", html_path, pdf_path], ]: try: subprocess.run(cmd, check=True, capture_output=True) return T ...[truncated 3542 chars]📊 {title}
财务分析报告 | 单位：亿元(CNY)- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The core purpose mostly aligns: the script performs financial analysis and creates rich reports with sparkline-like trend charts, and it supports HTML/PDF/DOCX/Markdown outputs. However, the declared description overstates supported inputs and triggers. The actual code only accepts a local Excel file path and parses .xlsx with openpyxl; there is no code for reading PDF files, CSV files, stock ticker lookup, or Feishu links/docs. Thus the description is not fully accurate and includes materially undeclared input capabilities that are absent from the code.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
- Feishu chat file attachment — Download via API:
bash # Get token TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") # Get file_key from message
- Feishu chat file attachment — Download via API:
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md -H 'Content-Type: application/json' \ -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") # Get file_key from message curl -s "https://open.feishu.cn/open-apis/im/v1/messages/{message_id}" -H "Authorization: Bearer $TOKEN" # Download curl -s "https://open.feishu.cn/open-apis/im/v1/messages/{message_id}/resources/{file_key}?type=file" \ -H "Authorization: Bearer $TOKEN" -o /tmp/data.xlsx
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Directing the agent to retrieve app credentials from local configuration and use them to access and transmit files establishes a powerful secret-to-network path. In this context, the skill processes uploaded financial data, so the combination materially increases the risk of unauthorized access and exfiltration.
- Content
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The script installs Python packages at runtime using os.system("pip install ..."), which executes a shell command and mutates the environment during normal operation. This creates supply-chain and environment integrity risk, and in this skill context it is more dangerous because the agent processes untrusted user files and should not also be fetching and executing code from package registries at runtime.
- Content
python try: import openpyxl except ImportError: os.system("pip install openpyxl -q") import openpyxl
os.system() or os exec-family call
High
- Category
- Dangerous Code Execution
- Confidence
- 99% confidence
- Finding
The Markdown fallback path installs markdownify at runtime via os.system("pip install ..."), again executing a shell command and downloading code dynamically. This is dangerous because a report-generation utility should not alter the host or trust live package retrieval when processing user-supplied documents.
- Content
python except (FileNotFoundError, subprocess.CalledProcessError): pass try: os.system("pip install markdownify -q") from markdownify import markdownify with open(html_path) as f: md = markdownify(f.read(), heading_style="ATX")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README advertises optional online benchmarking/search but does not disclose what data may be transmitted externally, which is important because users may upload sensitive financial statements or company data. In a finance-analysis skill, undisclosed network use can lead to unintended data exposure to third-party services or logs, especially when users expect local document processing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill uses shell commands and writes files but declares no explicit tool scope or permissions boundaries. That increases the blast radius because an agent may invoke broader capabilities than users expect, especially in a workflow that handles local files and external APIs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to read Feishu app credentials from local configuration and use them for direct API access. That is dangerous because it normalizes secret retrieval from local files and enables authenticated access to external systems without clear user consent or platform mediation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow accesses credentials and transmits user files to Feishu APIs without any user-facing warning about secret use or external data transfer. This undermines informed consent and may expose confidential financial documents to third-party services unexpectedly.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This command initiates authenticated external communication to Feishu to obtain an access token. External transmission is not always malicious, but here it is risky because it is paired with local secret use and can enable broader outbound data access.
- Content
- Feishu chat file attachment — Download via API:
bash # Get token TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id":"APP_ID","app_secret":"APP_SECRET"}' | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") # Get file_key from message
- Feishu chat file attachment — Download via API:
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes direct Feishu upload and message-sending steps that are not essential to the core report-generation logic. Embedding outbound file-delivery instructions creates an unnecessary data exfiltration channel for generated reports and any sensitive financial content they contain.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill tells the agent to upload generated reports to Feishu and send them as file messages, but does not warn that report contents leave the local environment. In a finance-analysis context, these files may include highly sensitive corporate or personal financial information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow explicitly creates a path for uploaded financial content to be repackaged into reports and transmitted through Feishu APIs. Because the skill's domain is financial analysis, the transmitted data is likely to be sensitive, making this more dangerous than generic file sharing guidance.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This command sends a file message through the Feishu API, creating a direct outbound channel for generated reports. In a financial-report skill, this can expose confidential financial analysis or source-derived content to external recipients if triggered without clear authorization.
- Content
md FILE_KEY=$(echo "$UPLOAD" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['file_key'])") # 2. Send file message to chat curl -s -X POST 'https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id' \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"receive_id\":\"CHAT_ID\",\"msg_type\":\"file\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Runtime package installation is not necessary for the declared purpose of financial report generation and introduces environment-modifying behavior plus remote code supply-chain exposure. In an agent skill that handles user-provided files, this unnecessary capability broadens the attack surface significantly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML output explicitly sets lang="zh-CN", and the surrounding generated report content is also fixed in Chinese throughout the file. This forces a specific language/locale without any opt-in or configuration mechanism, matching the language/locale policy violation criteria.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 84% confidence
- Finding
The wkhtmltopdf conversion executes an external renderer on generated HTML derived in part from workbook content and explicitly enables local file access. In this context, untrusted spreadsheet text can flow into HTML without escaping, making the renderer step more dangerous because it may process attacker-controlled markup with access to local files.
- Content
python ["wkhtmltopdf", "--quiet", "--enable-local-file-access", "--page-size", "A4", "--orientation", "Landscape", html_path, pdf_path], ]: try: subprocess.run(cmd, check=True, capture_output=True) return True except (FileNotFoundError, subprocess.CalledProcessError): pass
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 76% confidence
- Finding
Launching a headless browser with --no-sandbox to render attacker-influenced HTML materially weakens isolation. Because the HTML report includes unescaped content from input spreadsheets and company/ticker fields, this conversion step increases the risk that malicious HTML/JS or browser parsing bugs could impact the host.
- Content
python pass for browser in ["chromium-browser", "chromium", "google-chrome"]: try: subprocess.run([browser, "--headless", "--disable-gpu", "--no-sandbox", f"--print-to-pdf={pdf_path}", html_path], check=True, capture_output=True) return True except (FileNotFoundError, subprocess.CalledProcessError): continue
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def html_to_docx(html_path, docx_path): try: subprocess.run(["pandoc", html_path, "-o", docx_path, "--from=html"], check=True, capture_output=True) return True except (FileNotFoundError, subprocess.CalledProcessError): return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def html_to_markdown(html_path, md_path): try: subprocess.run(["pandoc", html_path, "-o", md_path, "--from=html", "--to=gfm"], check=True, capture_output=True) return True except (FileNotFoundError, subprocess.CalledProcessError): pass
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Markdown conversion fallback changes the host environment by installing a package on demand, which is unrelated to safe document transformation at runtime. This unnecessarily grants the script a code-fetching and execution path from an external repository.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Nearly all user-facing documentation is presented only in Chinese, while the file does not state that the skill is intended exclusively for a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This markdown reference uses substantial Chinese-language content alongside English headings and labels, which can impose a language/locale constraint on users without explicit opt-in. Under the policy rule, forcing a specific language is a natural-language policy concern unless the file offers a choice or clearly justifies the locale scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The script runs wkhtmltopdf, Chromium/Chrome, and pandoc as child processes, which is a safety-relevant operation for code files. Although conversion is part of the skill's purpose, there is no visible pre-execution disclosure in code comments, docstrings, or user-facing output that local external programs will be executed.
- Content
Static analysis
No suspicious patterns detected.