T08 · Insecure Dependencies
Warning
- Location
README.md:17- Finding
Unpinned Package Execution in the Documented Installation Procedure
- Content
View full analysis
- Remediation
View remediation
Security audit
Weekly Review
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a weekly-review report renderer, but it asks agents to collect AI session data and inspect local folders without clear limits.
Review the collection scope before installing or using this skill. It is best used when you intentionally want a Chinese weekly AI-usage report from selected sessions and workspaces. Avoid letting it scan arbitrary folders or session history, prefer user-supplied review-input JSON, and pin or verify the installer source before running npx.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:55- Finding
Insufficiently Scoped Session and Filesystem Collection Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
charts.py:346- Finding
Path Traversal Through an Unvalidated Chart Filename Component
- Content
View full analysis
dict[str, str]: period = data.get("period") or {} end = period.get("end") or "week" time_items, active = _collect_time_items(data) attr_items = _collect_attribution(data) token_items = _collect_token_trend(data) time_svg = _horizontal_bars( f"本周时间投入分布 (真实活跃 ≈ {active:.0f}h)", time_items or [("未分类", active or 1.0)], xlabel="真实活跃时长 (小时，已剔除挂机 idle)", ) dual_svg = _dual_vertical( "本周低效条目归因分布", attr_items, "Token 消耗趋势（百万）", token_items, ) return { f"chart-时间分布-{end}.svg": time_svg, f"chart-归因Token-{end}.svg": dual_svg, } def write_charts(data: dict[str, Any], charts_dir: str | Path) -> list[str]: out_dir = Path(charts_dir) out_dir.mkdir(parents=True, exist_ok=True) names: list[str] = [] for name, svg in build_chart_payloads(data).items(): (out_dir / name).write_text(svg, encoding="utf-8") names.append(name) return names ``` ### Technical Analysis The value of `period.end` comes from the input JSON and is directly embedded in two output filenames. Validation in `cli.py` only requires `period.start`; it does not validate the syntax or type of `period.end`. If `period.end` contains path separators and traversal components, `Path(out_dir) / name` interprets those characters as path components. The fixed filename prefix prevents a simple leading absolute-path override, but crafted values can still create nested paths and may traverse through parent components when compatible intermediate directories already exist. Because `write_text()` does not create intermediate directories, many traversal payloads will result in an exception rather than a successful external write. Thi ...[truncated 1459 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个功能较完整的自动复盘/分析/清理 Skill，而实际代码仅是一个报告渲染型 MCP 包装器：接收外部 Agent 已经采集好的 review_input，验证 period.start 是否存在，然后输出 Markdown 或 JSON。代码注释还明确说明“读会话存储由调用方 Agent 完成；本工具只做结构校验与渲染”“不读取任何本地会话数据库；采集由调用方 Agent 负责”。因此其主要实际能力远窄于声明范围。虽然‘周度复盘报告生成’这一部分与声明部分重合，但大量核心宣称能力在该代码中并未实现，构成明显的描述与行为不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill title and core description are presented only in Chinese, which indicates a language constraint in the skill’s natural-language interface. The file does not mention any user choice, opt-in, or justification for restricting the skill to Chinese-language usage.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to execute
npx skills add ...without pinning an exact package version or otherwise establishing supply-chain integrity. This can cause users to fetch and run whatever package version is current at install time, increasing exposure to malicious updates, typo-squatting, or compromised upstream publishing in a context where installation commands may be copied verbatim.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill references capabilities that imply environment access and file read/write behavior, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, this can cause the host to grant broader access than users expect, enabling unintended reading of conversation data, local files, or writing reports/charts to disk without explicit authorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description states the skill is '面向任意 AI Agent 自动复盘', but all user-facing instructions and invocation wording are presented only in Chinese with no opt-in or language-selection guidance. For a generally applicable skill, this creates a locale bias without documenting that the skill is intentionally region-specific or optional by language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises very broad trigger phrases around review, prompt optimization, summaries, visualization, and cleanup, which can cause over-invocation on common user requests. In practice this may prompt the agent to load the skill and request or access sensitive usage/session data in situations where the user did not intend a retrospective analysis or conversation cleanup workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The 'read_when' list is ambiguous and unconstrained, increasing the chance that the skill is auto-selected for generic tasks like prompt improvement or summaries. Because this skill is designed to work with session histories, disk checks, and open-conversation cleanup, ambiguous routing can expose more context or trigger more powerful actions than necessary.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 81% confidence
- Finding
The installation instruction uses an unpinned 'npx skills' flow, which can fetch the latest package or remote content at install time. This creates a supply-chain risk: a compromised or malicious upstream package version could execute unexpected code or install a modified skill without review.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains user-facing natural-language strings entirely in Chinese, including the module description and later chart titles/labels, which indicates the skill is designed to emit a fixed language output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and CLI description are written entirely in Chinese, indicating a language-specific user experience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code accesses environment variables to locate a local SQLite session database and then uses that path to read session records, which can contain sensitive user activity metadata such as titles, working directories, models, and automation details. There is no confirmation prompt, visible user-facing log, or warning in this file indicating that sensitive session data will be accessed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring and later user-facing strings are written in Chinese, and the tool description exposed through the MCP schema is also Chinese-only. This creates a natural-language locale policy concern because the skill appears to enforce a specific language without user opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The MCP tool description, input field descriptions, and runtime validation errors are all presented only in Chinese. Because these strings are surfaced to users or calling agents, the file fixes interaction to one language without offering choice or documenting a region-specific reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language instructions describe the report generator entirely in Chinese, including the module docstring and class docstring, which strongly indicates the skill is intended to render output in a fixed language. There is no visible option, parameter, or documented opt-in allowing users to choose another language or locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill documentation is written in Chinese and prescribes fixed Chinese output text such as the required title template, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and multiple user-visible exception messages are written in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is region-specific. Under the stated policy, locale-specific messaging should either be optional or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language strings in the module and docstrings are written exclusively in Chinese, which can constitute a language/locale policy violation when no user choice, opt-in, or documented region-specific constraint is provided. The file contains no indication that Chinese is required for a justified locale-specific purpose.
- Content
Static analysis
No suspicious patterns detected.