Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
CSV数据分析器
Security checks for vulnerabilities and agentic risk
Overview
This looks like a CSV analysis helper, but it mixes local-only claims with unclear callback, API-key, and API-connection instructions.
Review this before installing. It may be acceptable if you only use it for local CSV work, but do not provide API keys or callback URLs unless the publisher clearly documents the external service, data sent, and consent controls. Confirm output paths before writing files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The display name, summary, and description are presented primarily in Chinese, with no indication that users may choose another language. This can constitute a language/locale policy issue when the skill effectively defaults to a specific language without opt-in or documented justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The summary describes the skill with a generic 'analyze CSV with simple commands' formulation but does not specify exact invocation wording, constraints, or negative examples. In a manifest/markdown context, this leaves the trigger boundary ambiguous.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says the skill should be used when there is a need for data analysis, report generation, statistical insights, or data visualization. These are broad, everyday work requests rather than narrow trigger phrases, so the activation scope is unclear and could cause unintended invocation for many unrelated analytics tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The request format exposes a callback_url for asynchronous completion but provides no warning that results, metadata, or status information may be transmitted over the network. In a nominally local CSV-analysis skill, undocumented callback behavior materially raises exfiltration risk because users may assume processing is local-only while data or file-derived insights are sent to an external endpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill documents writing output files via --output without warning about overwriting existing files or modifying the workspace. In an agent context with write and exec permissions, unclear file-write behavior can lead to unintended data loss, clobbering of user files, or writing sensitive derived data to unsafe locations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation contradicts itself by first claiming no extra API key is required, then later instructing users to configure API keys and initialize API connections. This can mislead operators into supplying unnecessary secrets to a skill that appears to be a local CSV tool, increasing the chance of credential exposure or unsafe trust in undocumented behaviors.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file mixes two incompatible operational models: a local CSV command-line analyzer and an API/integration setup flow. The support and installation sections describe API connection setup and generic exec troubleshooting that do not align with the concrete CSV-analysis commands documented in the main functionality section.
- Content
Static analysis
No suspicious patterns detected.