Auto Weekly Report System

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

The skill is a plausible weekly-report helper, but it creates and recommends running predictable shell scripts from /tmp with unescaped user input and business-report content, so it should be reviewed before installation.

Install only in a trusted local environment and review the generated report before any Enterprise WeChat publication. Do not run the generated /tmp bash scripts with untrusted titles or data; use private output directories, validate titles, and keep scheduled publishing disabled until the workflow has an explicit review gate.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/publisher.py:53

Finding

Shell Command Injection Through an Unsanitized Document Title

Content

View full analysis

" ``` 3. `publisher.py` embeds the title in `/tmp/publish_commands.sh`. 4. The generated single-quoted argument is terminated by the injected quote. 5. The program instructs the user to execute: ```bash bash /tmp/publish_commands.sh ``` 6. Bash interprets the injected metacharacters and executes the attacker-controlled command with the invoking user's privileges. ### Impact Assessment Successful ...[truncated 639 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collector.py:173

Finding

Predictable Shared Temporary Files Permit Symlink and File-Tampering Attacks

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generator.py:138

Finding

Untrusted Price Data Is Embedded into Published Markdown Without Escaping

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

主要不一致点在于“全自动”和“发布到企业微信文档”。该脚本的前两步确实符合“收集数据→生成报告”的流水线描述，但第3步明确标注为‘模拟模式’，既没有调用企业微信 API，也没有自动执行发布命令，只是写出一个 shell 脚本供人工执行。此外，所谓定时功能也只是输出一段 cron 示例，而非内置触发器。因此，代码实现的是半自动/手动辅助发布的周报流水线，而不是描述中的全自动定时发布系统。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

描述声称这是“全自动周报系统”，包括定时收集数据、生成周报并发布到企业微信文档。就当前代码片段来看，确实与周报生成相关，也会调用 collector.py 触发数据收集，因此与“收集+生成”部分基本一致。但代码中没有看到任何企业微信文档发布逻辑，也没有定时任务、调度器或触发机制实现。其可见能力仅是本地调用收集脚本、读取 JSON、生成 Markdown、写入 /tmp 文件并打印。因此声明的主要用途有部分成立，但包含了当前代码未体现的关键能力，尤其是“发布到企业微信文档”和“定时自动化”两点，构成描述与实际行为不完全一致的能力夸大。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an end-to-end fully automated weekly report system with timed data collection, report generation, and publishing to WeCom. The supplied code chunk implements only one limited part of that workflow: a publisher helper. Even within publishing, it does not directly invoke WeCom APIs; it merely prints CLI commands and writes them to /tmp/publish_commands.sh for manual completion. There is no evidence here of scheduling, source data retrieval, aggregation, or report generation. Therefore the code's actual behavior is materially narrower than the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

This is a genuine tool-parameter abuse pattern because shell=True allows the shell to parse metacharacters in the command string. In an automation skill that orchestrates multiple pipeline steps and may be scheduled via cron, even modest control over command inputs or script path resolution could lead to arbitrary command execution under the job's privileges.

Content

Scanner excerpt · scripts/full_pipeline.py (reported line 18)May include surrounding context.

python

print(f"📌 {name}")
    print(f"{'='*60}")
    
    result = subprocess.run(command, shell=True, capture_output=False, text=True)
    
    if result.returncode != 0:
        print(f"❌ {name} 失败")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly promotes automatic publication of generated reports to Enterprise WeChat, but it does not warn users that collected business data will be transmitted to an external collaboration platform. In a reporting/automation skill that aggregates multiple data sources, this omission can lead to unintended disclosure of sensitive internal metrics through unattended use or misconfiguration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron example documents a fully unattended pipeline that generates and publishes reports automatically, but it does not warn that scheduled execution may send data without human review. This increases the risk of recurring unauthorized or accidental disclosure if report content, recipients, or permissions are misconfigured.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises shell execution and file read/write behavior through its documented commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and review gap: a caller may invoke a skill with broader host capabilities than expected, including access to local files under /tmp and arbitrary script execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text is broad enough to match many ordinary reporting, sync, or aggregation requests, increasing the chance this skill is invoked in contexts where users did not intend shell execution or document publication. In this skill's context, overbroad routing is more dangerous because the workflow may process internal operational data and publish outputs externally to Enterprise WeChat documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage instructions show a publishing step to Enterprise WeChat but omit a clear warning that generated report contents may include sensitive internal data and will be sent to an external collaboration platform. This is dangerous because users may run the publish command without realizing the confidentiality impact, especially when the data sources include production logs, configuration files, and monitoring data from /tmp.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring is written entirely in Chinese, and user-facing status and progress messages throughout the script are also hard-coded in Chinese. This indicates a language-specific behavior without any visible opt-in, fallback, or justification that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest centers on automatically collecting business/project data and generating weekly reports for team synchronization. collect_system_health adds host environment monitoring such as disk usage and log-file presence, which broadens the behavior from project-data aggregation into system-health auditing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes a weekly reporting system that collects project data from v3.5, InStreet, and price monitoring sources, then generates and publishes a report. This file additionally executes the external df command via subprocess.run to inspect host disk usage, which is a host-level capability not clearly justified by the stated reporting scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/collector.py (reported line 130)May include surrounding context.

python

try:
            # 磁盘空间
            result = subprocess.run(['df', '-h', '/tmp'], capture_output=True, text=True)
            disk_line = result.stdout.strip().split('\n')[-1]
            disk_usage = disk_line.split()[4] if len(disk_line.split()) > 4 else "未知"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring presents the skill description only in Chinese, and the rest of the user-facing output is likewise Chinese. This creates a natural-language locale constraint without opt-in or justification, which matches the policy-violation category for forced language/locale behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code executes shell commands via subprocess.run(..., shell=True), which enables shell interpretation of the command string. Although the current call sites build commands from an internal script_dir path, using shell=True creates unnecessary command-injection risk if the path or command components ever become influenced by environment, filesystem naming, or future code changes.

Content

Scanner excerpt · scripts/full_pipeline.py (reported line 18)May include surrounding context.

python

print(f"📌 {name}")
    print(f"{'='*60}")
    
    result = subprocess.run(command, shell=True, capture_output=False, text=True)
    
    if result.returncode != 0:
        print(f"❌ {name} 失败")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring states 报告生成器 - 将数据转换为 Markdown 周报, which implies a pure generation role. But the executable path first runs collector.py before generating the report, so the documented intent of this file contradicts its actual side effects and responsibilities.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The docstrings, headings, status text, and generated report content are written exclusively in Chinese, indicating the skill is designed to produce output in a fixed language. There is no natural-language indication that the user can choose a different language or that the Chinese-only behavior is a documented, justified locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes an automated weekly reporting system that collects data, generates reports, and publishes them; this file is documented as a generator that converts data into Markdown weekly reports. However, the main block invokes collector.py through subprocess.run, which introduces process-spawning capability rather than just generating a report from existing data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script invokes another program via subprocess to run collector.py, but there is no confirmation prompt and no user-facing notice before this action occurs. In this file, the operation is only implied by an internal comment, which is not a sufficient disclosure to the user for code that executes another script.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generator.py (reported line 185)May include surrounding context.

python

if __name__ == "__main__":
    # 先生成数据
    import subprocess
    subprocess.run(["python3", str(Path(__file__).parent / "collector.py")])
    
    # 生成报告
    generator = ReportGenerator()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and user-facing text are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. This matches the policy category for language/locale constraints expressed in natural language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description emphasizes a fully automated weekly reporting system that generates and publishes reports to Enterprise WeCom documents. In this implementation, the publisher does not actually invoke a publishing API or complete the publish flow; it merely displays wecom_mcp commands and saves them for a user to run manually, which is a meaningful behavior mismatch at the skill-intent level.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill description is presented only in Chinese and gives no indication that users can choose another language or locale. Under the policy, language constraints should either offer opt-in/choice or be explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script writes a generated report to a filesystem path, which is a safety-relevant operation under the rule. Although it prints the saved path afterward, there is no prior warning, confirmation, or external documentation in this file indicating that running the script will create or overwrite this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.