Security audit

Dairy Market Report

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate China dairy market report generator with disclosed document-reading and PDF-rendering behavior, and no hidden persistence, credential access, exfiltration, or destructive actions.

Install and run this skill only in a dedicated project folder containing the dairy PDFs and data files you intend it to read. Use a virtual environment with pinned dependencies where possible, and review generated PDFs when source documents or JSON data come from untrusted parties because crafted text could alter formatting or break rendering.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:168
Finding: Unpinned Third-Party Package Installation Guidance
Content: View full analysis
Remediation: View remediation
--hash=sha256: pypdf== --hash=sha256: python-docx== --hash=sha256: ``` 2. Generate and enforce hashes for all direct and transitive dependencies. Install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Require an explicitly trusted package index, preferably through centrally managed configuration. Do not permit fallback to arbitrary extra indexes. 4. Install dependencies inside an isolated, least-privileged virtual environment or container rather than the host or system Python environment. 5. Replace ad hoc installation instructions in `SKILL.md` and script error messages with references to the reviewed lockfile. 6. Do not automatically install missing dependencies at runtime. Fail safely and require an explicit, auditable setup step. 7. Periodically scan locked dependencies for known vulnerabilities and review lockfile updates before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/render_pdf.py:163
Finding: Externally Derived Report Content Is Interpreted as ReportLab Markup
Content: View full analysis
' f'{title}
' f'{period_disp} · 月度报告
' f'数据源：{sources}
' f'生成时间：{generated}' f'' ) ``` `scripts/render_pdf.py:188-199`: ```python bullet_items = [] for t in key_takeaways: bullet_items.append( f'● {t}' ) bullets_html = "

".join(bullet_items) card_html = ( f'CORE TAKEAWAYS · 核心结论' f'

{bullets_html}' ) card = Table( [[Paragraph(card_html, _style("card", leading=14, fontSize=9.5))]], colWidths=[USABLE_W], ) ``` `scripts/render_pdf.py:263-283`: ```python for row in rows: cells = [] for ci, raw in enumerate(row): txt = str(raw) if raw is not None else "" if ci in change_cols: # Render as a colored pill cls = _classify_change(txt) color = {"up ...[truncated 4360 chars]
Remediation: View remediation
str: return escape( "" if value is None else str(value), entities={'"': """, "'": "'"}, ) ``` 2. Apply `safe_text()` to titles, periods, sources, generated dates, key takeaways, KPI fields, table headers and cells, section titles, narratives, callouts, and table-of-contents entries. 3. Preserve trusted layout markup separately from untrusted text. For example: ```python safe_title = safe_text(title) band_html = ( '' f'{safe_title}' '' ) ``` 4. For multiline plain text, escape the value before converting newline characters: ```python safe_callout = safe_text(text).replace("\n", "
") inner = Paragraph(safe_callout, S_CALLOUT) ``` 5. If limited formatting is intentionally supported, implement an explicit allowlist of permitted tags and attributes. Reject hyperlink tags and any unsupported URI schemes unless interactive links are a documented requirement. 6. Add schema validation before rendering: - Require expected scalar and collection types. - Enforce exactly the supported fields. - Set reasonable maximum lengths and table dimensions. - Validate color fields against an allowlist rather than accepting arbitrary strings. - Reject malformed or unexpected nested objects. 7. Add security regression tests using values containing `<`, `>`, `&`, quotes, malformed tags, nested tags, and hyperlink markup. Confirm that the generated PDF displays these values literally or rejects them safely. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to enumerate the working directory and ingest many file types, including supplementary documents, without requiring user confirmation or limiting scope to user-designated inputs. This can cause unintended collection and processing of unrelated sensitive local files if they happen to be present in the workspace, creating a data exposure and over-collection risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require the report prose to be written in Chinese, and later reinforce this with 'Stay in Chinese' as a guardrail. This is a natural-language policy issue because it forces a specific language/locale rather than offering the user an opt-in or honoring user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This line explicitly instructs the skill to remain in Chinese for prose, with no opt-in or alternative language path. That creates a locale/language policy violation under SQP-3 because the skill forces a specific language instead of offering choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML document declares lang="zh-CN", and the visible report content is written entirely in Chinese, which indicates the skill output is fixed to a specific language/locale. Under the policy criteria, forcing a locale without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown instructs that key takeaways must be 'short Chinese strings,' which imposes a specific language requirement. Similar Chinese-only requirements appear elsewhere in the schema, but no opt-in, alternative locale support, or justification is provided, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The schema specifies 'Chinese section title' and uses Chinese-formatted source/callout expectations, effectively forcing one locale. Because the file does not explain that this is a region-specific skill or provide a language choice, this is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file title and all operating instructions are written in Chinese, and there is no indication that language choice is optional or limited to a justified region-specific workflow. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document is entirely written in Chinese and provides operational instructions only in that language, with no indication that users may choose another language or that the skill is restricted to a Chinese-language/regional context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown explicitly requires a report of 6000–9000 Chinese characters, which imposes a specific language/locale on the skill output. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script emits Chinese text in its markdown output and CLI description/help (for example, the header and argument parser description) with no option to select another language. This is a natural-language policy concern because the file imposes a specific locale rather than offering user opt-in or documenting a justified region-specific restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains user-facing natural language that fixes the generated report title, labels, and usage context to Chinese, such as the report name and Chinese rendering rationale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file labels the report in Chinese and prioritizes Chinese fonts, suggesting the skill output is tailored to a specific locale. Because no surrounding text in this file offers a language choice or documents a justified region-specific constraint, this may violate the requirement not to force a specific language or locale without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.