KT 合同审查专家

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.1

Overview

This is a disclosed Chinese contract-review skill that reads user-provided contracts and can generate a local report, with some non-blocking caution around dependency pinning, broad triggers, and Markdown report handling.

Install this only if you are comfortable using a Chinese-language contract-review helper on sensitive business documents. Use an isolated environment, consider pinning python-docx, and treat generated Markdown reports as sensitive files because they may contain contract excerpts and could render untrusted contract text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:15-18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip3 install python-docx

Technical Analysis

The documented installation command installs the latest available version of python-docx and its transitive dependencies without a version constraint, lock file, or cryptographic integrity hashes. Consequently, the installed code may differ across environments and over time.

This creates a software supply-chain risk. If a future package version or transitive dependency is compromised, users following the documented installation procedure could install and execute malicious code. The audit found no evidence that the current python-docx package is malicious; the vulnerability is the absence of dependency pinning and integrity verification.

Attack Path

1. An attacker compromises a future release of python-docx or one of its transitive dependencies.
2. A user follows the installation command in README.md.
3. pip resolves and downloads the compromised release because no reviewed version or hash is specified.
4. Malicious package code executes during installation or when contract_review.py imports the package.
5. The code operates with the permissions of the user running the installation or review script.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that user's privileges, the compromised dependency could access readable contract files, environment variables, credentials, and other local data, or modify files available to the account. This issue does not independently provide privilege escalation beyond the invoking user's permissions.

Remediation

View remediation

Remediation Suggestions

• Pin python-docx to a specifically reviewed version.
• Maintain dependencies in a version-controlled requirements or lock file.
• Record and verify cryptographic hashes using pip --require-hashes.
• Pin and audit transitive dependencies where practical.
• Use automated dependency vulnerability monitoring and periodically review pinned versions.
• Install dependencies in an isolated virtual environment with least privilege.

Example hardened workflow:

text

# requirements.txt
python-docx==REVIEWED_VERSION --hash=sha256:VERIFIED_PACKAGE_HASH

bash

python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Note

• Location: contract_review.py:255

Finding

Markdown Report Injection Through Unescaped Contract Content

Content

View full analysis

Vulnerability Details

File Location: contract_review.py:255 and contract_review.py:269
Vulnerability Type: Improper neutralization of untrusted content in Markdown output
Risk Level: Low

Vulnerable Code

python

if info['issues']:
    for issue in info['issues'][:5]:  # 最多 5 个
        lines.append(f"- {issue['message']}")
        lines.append(f"  - 上下文：`...{issue['context']}...`")

python

for h in high_risks:
    lines.append(f"**#{h['num']} {h['name']}**")
    lines.append(f"- 建议：{h['suggestion']}")
    if h['matches']:
        lines.append(f"- 出现 {len(h['matches'])} 处，例：`...{h['matches'][0]}...`")

Contract-derived values are created without output encoding:

python

context = text[start:end].replace('\n', ' ')

Technical Analysis

The script treats contract files as untrusted input but inserts matched contract text directly into Markdown inline-code spans. It only replaces newline characters and does not escape backticks, HTML, Markdown links, images, or other active formatting syntax.

A crafted contract can include a backtick that closes the intended inline-code span, followed by attacker-controlled Markdown or raw HTML. When the generated report is rendered, the injected material may appear as legitimate report content. Depending on the Markdown viewer's policy, injected images or other remote resources may also cause outbound requests.

The issue affects both principle-check context at line 255 and high-risk habit examples at line 269. Exploitation requires the malicious text to fall within a regex match's captured context and for a user or downstream system to render the generated report.

Attack Path

1. An attacker supplies a contract containing text that triggers one of the review regular expressions.
2. Within approximately 20 or 30 characters of the matching text, the attacker places a backtick followed by crafted Markdown or HTML.
3. The vi ...[truncated 963 chars]

Remediation

View remediation

Remediation Suggestions

• Apply context-appropriate Markdown escaping to every value derived from contract content.
• At minimum, neutralize backticks, backslashes, raw HTML delimiters, links, and image syntax.
• Prefer fenced code blocks using a delimiter longer than any backtick sequence present in the input.
• Configure supported Markdown renderers to disable raw HTML and remote resources.
• Consider generating a structured format such as JSON first, followed by rendering through a well-tested escaping library.
• Add regression tests using contracts containing backticks, HTML tags, links, images, and nested Markdown syntax.

A safe helper should encode untrusted values before interpolation, for example:

python

def escape_markdown_inline(value: str) -> str:
    return (
        value.replace("\\", "\\\\")
             .replace("`", "\\`")
             .replace("<", "&lt;")
             .replace(">", "&gt;")
    )

safe_context = escape_markdown_inline(issue["context"])
lines.append(f"  - Context: `{safe_context}`")

Renderer-level restrictions should still be applied because ad hoc escaping may not cover every Markdown dialect.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill description, usage guidance, and output example are presented only in Chinese, which effectively imposes a specific language/locale on users. The file does not mention that the skill is Chinese-only by design, offer an alternative language, or provide an explicit opt-in for this locale constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary conversation about contracts, such as generic requests to 'review this contract' or 'what risks are in the contract'. In an agent skill system, this can cause unintended auto-invocation, pulling unrelated user content into the skill and producing actions or analysis outside the user's precise intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code ingests the full contents of user-supplied contract documents and later writes an analysis report to disk, which is a user-data handling operation with potential confidentiality impact. While the script prints basic progress messages, there is no warning in comments, docstrings, or user-facing text that sensitive contract content will be read and may be stored in an output file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions, triggers, and output examples are presented only in Chinese, and the skill does not indicate that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, labels, and usage text are entirely in Chinese, and the script presents its interface and outputs in Chinese only. There is no indication that the user can choose another language or that the locale restriction is an intentional, documented regional requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.