Pugongying Data Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:17 AM UTC
• Version: 1.0.1

Overview

This is a coherent Chinese data-engineering skill suite with expected local project-scaffolding behavior, but users should review generated files, dependencies, and deployment steps before acting on them.

Install this if you want a Chinese data-engineering workflow suite. Run the init scripts only in a new or disposable project directory, use simple trusted project names, review generated code and YAML packages before sharing, pin dependencies before installing, and require explicit human approval before any production deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Warning

• Location: dq-assistant/scripts/init-project.sh:102

Finding

Unescaped project name permits sed program injection in the data-quality initializer

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: etl-assistant/scripts/init-project.sh:151

Finding

Unescaped project arguments permit sed program injection in the ETL initializer

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: modeling-assistant/scripts/init-project.sh:108

Finding

Unescaped project arguments permit sed program injection in the modeling initializer

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: sql-assistant/scripts/init-project.sh:93

Finding

Unescaped project name permits sed program injection in the SQL initializer

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: test-engineer/scripts/init-project.sh:89

Finding

Unescaped project name permits sed program injection in the test-project initializer

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: etl-assistant/scripts/init-project.sh:236

Finding

Generated ETL environment installs mutable dependency versions without integrity verification

Content

View full analysis

=2.0.0 numpy>=1.24.0 sqlalchemy>=2.0.0 # Database Drivers psycopg2-binary>=2.9.0 pymysql>=1.1.0 # Cloud google-cloud-bigquery>=3.0.0 boto3>=1.28.0 # Airflow apache-airflow>=2.7.0 apache-airflow-providers-google>=10.0.0 # Testing pytest>=7.4.0 pytest-cov>=4.1.0 pytest-mock>=3.11.0 great-expectations>=0.17.0 # Monitoring prometheus-client>=0.17.0 # Utils python-dotenv>=1.0.0 pydantic>=2.0.0 pyyaml>=6.0.0 ``` The script then instructs the user to install the generated dependency set: ```bash echo " pip install -r requirements.txt" ``` ### Technical Analysis The generated requirements use broad lower bounds rather than reviewed exact versions. They do not include package hashes or a generated lock file. Consequently, identical installations performed at different times may retrieve different package versions and transitive dependency graphs. This is not evidence that any currently named package is malicious. The risk is that future compromised, vulnerable, or incompatible releases may be selected automatically without review. Python package installation may execute package build logic, making dependency integrity particularly important. The test-project initializer also contains installation guidance at `test-engineer/scripts/init-project.sh:278` and `test-engineer/scripts/init-project.sh:342`: ```bash pip install -r requirements.txt echo " 2. pip install -r requirements.txt" ``` ### Attack Path 1. A user runs the ETL initializer. 2. The initializer creates a requirements file containing mutable version ranges. 3. The user follows the generated `pip install -r requirements.txt` instruction. 4. Pip resolves versions available from the configured package index at ...[truncated 655 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (118)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared purpose is an end-to-end data development suite, but the analyzer indicates the effective behavior may primarily initialize testing assets or templates. Such description-behavior divergence weakens user consent and review because a skill that appears general and benign may actually perform narrower but side-effecting actions in the filesystem.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared purpose is an end-to-end data development suite, but the analyzer indicates the effective behavior may primarily initialize testing assets or templates. Such description-behavior divergence weakens user consent and review because a skill that appears general and benign may actually perform narrower but side-effecting actions in the filesystem.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is an end-to-end data development suite, but the analyzer indicates the effective behavior may primarily initialize testing assets or templates. Such description-behavior divergence weakens user consent and review because a skill that appears general and benign may actually perform narrower but side-effecting actions in the filesystem.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · etl-assistant/scripts/init-project.sh (reported line 474)May include surrounding context.

sh

# Environment
.env
.env.local
.env.*.local

# Config with secrets

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · architecture-designer/scripts/init-project.sh (reported line 432)May include surrounding context.

sh

*.pem
*.p12
.credentials/
secrets.yaml
secrets.yml

# 临时文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · requirement-analyst/scripts/init-project.sh (reported line 324)May include surrounding context.

sh

*.pem
*.p12
.credentials/
secrets.yaml
secrets.yml

# 临时文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · architecture-designer/scripts/init-project.sh (reported line 433)May include surrounding context.

sh

*.p12
.credentials/
secrets.yaml
secrets.yml

# 临时文件
*.tmp

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · requirement-analyst/scripts/init-project.sh (reported line 325)May include surrounding context.

sh

*.p12
.credentials/
secrets.yaml
secrets.yml

# 临时文件
*.tmp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · dq-assistant/scripts/init-project.sh (reported line 105)May include surrounding context.

sh

# 替换占位符
sed -i.bak "s/PROJECT_NAME_PLACEHOLDER/$PROJECT_NAME/g" "$PROJECT_DIR/PROJECT.md"
sed -i.bak "s/CREATE_TIME_PLACEHOLDER/$(date '+%Y-%m-%d')/g" "$PROJECT_DIR/PROJECT.md"
rm -f "$PROJECT_DIR/PROJECT.md.bak"

# 创建 README.md
cat > "$PROJECT_DIR/README.md" << EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · etl-assistant/scripts/init-project.sh (reported line 154)May include surrounding context.

sh

# 替换占位符
sed -i.bak "s/PROJECT_NAME_PLACEHOLDER/$PROJECT_NAME/g" "$PROJECT_DIR/PROJECT.md"
sed -i.bak "s/CREATE_TIME_PLACEHOLDER/$(date '+%Y-%m-%d')/g" "$PROJECT_DIR/PROJECT.md"
rm -f "$PROJECT_DIR/PROJECT.md.bak"

# 创建 README.md
cat > "$PROJECT_DIR/README.md" << EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · modeling-assistant/scripts/init-project.sh (reported line 111)May include surrounding context.

sh

# 替换占位符
sed -i.bak "s/PROJECT_NAME_PLACEHOLDER/$PROJECT_NAME/g" "$PROJECT_DIR/PROJECT.md"
sed -i.bak "s/CREATE_TIME_PLACEHOLDER/$(date '+%Y-%m-%d')/g" "$PROJECT_DIR/PROJECT.md"
rm -f "$PROJECT_DIR/PROJECT.md.bak"

# 创建 README.md
cat > "$PROJECT_DIR/README.md" << EOF

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · sql-assistant/scripts/init-project.sh (reported line 95)May include surrounding context.

sh

# 替换占位符
sed -i.bak "s/PROJECT_NAME_PLACEHOLDER/$PROJECT_NAME/g" "$PROJECT_DIR/PROJECT.md"
sed -i.bak "s/CREATE_TIME_PLACEHOLDER/$(date '+%Y-%m-%d')/g" "$PROJECT_DIR/PROJECT.md"
rm -f "$PROJECT_DIR/PROJECT.md.bak"

# 创建 README.md
cat > "$PROJECT_DIR/README.md" << EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · architecture-designer/scripts/init-project.sh (reported line 434)May include surrounding context.

sh

# 创建 .gitignore
cat > "$PROJECT_DIR/.gitignore" << 'EOF'
# 数据库配置文件（可能包含敏感信息）
*.env
config/local.*

# 大型执行计划文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · dq-assistant/scripts/init-project.sh (reported line 189)May include surrounding context.

sh

# 创建 .gitignore
cat > "$PROJECT_DIR/.gitignore" << 'EOF'
# 数据库配置文件（可能包含敏感信息）
*.env
config/local.*

# 大型执行计划文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · etl-assistant/scripts/init-project.sh (reported line 473)May include surrounding context.

sh

# 创建 .gitignore
cat > "$PROJECT_DIR/.gitignore" << 'EOF'
# 数据库配置文件（可能包含敏感信息）
*.env
config/local.*

# 大型执行计划文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · modeling-assistant/scripts/init-project.sh (reported line 215)May include surrounding context.

sh

# 创建 .gitignore
cat > "$PROJECT_DIR/.gitignore" << 'EOF'
# 数据库配置文件（可能包含敏感信息）
*.env
config/local.*

# 大型执行计划文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · sql-assistant/scripts/init-project.sh (reported line 164)May include surrounding context.

sh

# 创建 .gitignore
cat > "$PROJECT_DIR/.gitignore" << 'EOF'
# 数据库配置文件（可能包含敏感信息）
*.env
config/local.*

# 大型执行计划文件

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes a trigger description listing broad terms such as "数据开发" and "数据仓库" alongside "等", which makes the trigger scope open-ended and ambiguous. Because the file provides no exclusions, negative examples, or narrower invocation context, these phrases could match ordinary discussion rather than intentional skill activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The line states that all skill documentation is in Chinese, which is a natural-language locale constraint. Because the file does not indicate user choice, opt-in, or a documented region-specific justification, this appears to violate the policy against forcing a specific language/locale.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

bash

# 查看所有可用命令
ls -la ~/.openclaw/skills/pugongying-data-skills/

# 使用单个模块
/sql-assistant 生成用户活跃度分析SQL

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

该README明确说明各模块会输出并在模块间交换标准化YAML数据包，还给出了包含项目名、实体、指标和保留期等内容的示例。对于会影响数据隐私和项目信息暴露的行为，文档中没有任何用户警示或最小化/脱敏建议，符合markdown文件的缺少用户警告情形。

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 188)May include surrounding context.

ls ~/.openclaw/skills/ | grep pugongying

检查Frontmatter格式

head -20 ~/.openclaw/skills/pugongying-data-skills/SKILL.md

text

2. **模块联动失败**

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill advertises operational behaviors such as reading local files (for example, cat skill-connections.yaml and cat skill-hub.md) but does not declare any explicit tool scope or permission boundaries. This creates ambiguity about what filesystem or environment access the skill may exercise, which can lead to over-privileged execution or unsafe assumptions by the host agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text and trigger words are extremely broad, covering common terms like data development, ETL, SQL optimization, data quality, modeling, and architecture design. In a general coding environment this can cause unintended routing of many ordinary user requests into this skill, increasing the chance of unnecessary file access, generation, or other downstream actions without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The documentation includes deployment-oriented behavior (/test-engineer 验证并部署) without any warning, approval gate, or safety constraints around system-impacting actions. Even as documentation, this normalizes potentially state-changing operations and may lead an agent or user to treat deployment as part of the default flow without adequate review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.