Security audit

CSV数据分析-免费版

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only CSV analysis skill whose read/exec and CSV output behavior fit its purpose, though parts of the documentation are broad and confusing.

Install only if you are comfortable letting the agent read CSV files and run local shell commands for analysis. Treat --output as creating a new local file, avoid sensitive CSVs unless you trust the agent environment, and ignore or clarify the unsupported API and multi-format claims before relying on them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest markets the skill as a lightweight, zero-external-dependency CSV analyzer, but the body also declares an LLM API dependency and broader capabilities. This mismatch can mislead operators about the trust boundary and runtime behavior, causing them to approve a skill with more privilege or connectivity assumptions than expected.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description says the skill should be used whenever the user needs data analysis, report generation, statistical insights, or data visualization, which are broad everyday request categories rather than narrowly scoped trigger conditions. It does not provide explicit trigger phrases, constraints, or negative examples beyond excluding real-time stream processing, increasing the chance of unintended invocation for general analytics requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest and feature description explicitly state 支持中文交互 and 本技能涵盖中文交互, but they do not indicate that other languages are supported or that the user can opt in to Chinese. This creates a language policy concern because it frames a specific language as the interaction mode without offering a locale choice or justification for a region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The examples encourage writing filtered output files without clearly warning the user that the skill may modify the filesystem. In an agent setting, undisclosed write behavior can surprise users, overwrite local data, or create sensitive derivative files in unintended locations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document first limits the free edition to stats and filter, then later asserts broad automation, API, file-processing, and command-execution capabilities. In the context of a skill with allowed tools read and exec, this inconsistency increases risk because it obscures what actions the agent may attempt under an apparently simple CSV-analysis label.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is advertised as providing only stats and filter for CSVs, but later claims generic automation, multi-format file handling, API integration, and command execution. This scope expansion is dangerous because users may invoke or approve the skill under a narrow data-analysis mental model while it presents itself as a much broader execution-capable tool.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Advertising external API integration in a CSV-only analysis skill creates unnecessary ambiguity around network access and data egress. In a data-analysis context, that can cause users to expose sensitive CSV contents to external services they did not expect this skill to involve.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill is consistently presented as a CSV analyzer, with examples and limitations focused on CSV files only. Claiming generic multi-format file processing expands the capability beyond the stated purpose without support or justification in the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.