Security audit

数据工具箱(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward data-analysis helper skill, but users should be careful because it can guide file, command, database, and API work.

Install only if you want an agent to help with local data analysis workflows. Review generated scripts before running them, avoid exposing sensitive CSVs, database credentials, or API tokens unnecessarily, and require explicit confirmation before database writes, deletes, exports, or command execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The keyword coverage section enumerates extremely broad and fragmented trigger phrases, effectively encouraging activation on vague references to analysis, reporting, automation, and developer work. In a skill with exec and write permissions, such loose triggering materially raises the risk of overbroad invocation, unintended data processing, and system-impacting actions outside the user's precise request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation guidance is overly broad ('适用于需要data toolkit相关能力的开发场景'), which can cause the agent to invoke a high-privilege skill in contexts that do not clearly require it. Because the skill has read, write, glob, and exec capabilities, ambiguous routing increases the chance of unnecessary filesystem access, command execution, or handling sensitive data without strong user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest advertises read, exec, write, and glob capabilities but does not pair them with prominent warnings or safeguards about system-impacting behavior. In practice, this means a broadly-triggered skill could create or overwrite files, enumerate the filesystem, or execute shell commands with insufficient user awareness, which is especially risky for a data-processing skill expected to touch local and database resources.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The document is overwhelmingly written in Chinese and examples, prompts, and outputs are presented in Chinese, but there is no statement that users may choose another language. This can be a language/locale policy issue when a skill implicitly enforces one language without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation discusses database loading, API pulling, and file reading as standard workflows without a clear privacy, credential-handling, or data-transmission warning. In a data-tool context, users may provide sensitive business or personal data; absent warnings and consent checkpoints, the skill encourages access patterns that could expose confidential data or misuse credentials.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a personal-developer data toolkit focused on extraction, cleaning, exploratory analysis, and basic visualization. However, the skill documentation explicitly states support for "创建/查询/修改/删除" operation modes, which goes beyond the stated analytics-oriented lifecycle scope and introduces generic destructive data manipulation behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Trigger phrases like '这份数据说明了什么？' or '和上季度比怎么样？' are ordinary conversational requests that may match many unrelated contexts. When tied to a powerful skill, this ambiguity can cause automatic activation on insufficiently scoped prompts, leading to unintended access to local files, databases, or execution pathways the user did not explicitly authorize.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The '已知限制' section says the free version does not include '数据血缘追踪与转换谱系管理'. Earlier, the best-practices section explicitly directs maintaining a structured transformations lineage record, which contradicts the stated absence of that capability rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest and limitations frame the free edition as a core data-processing toolkit without workflow automation. Yet the capability coverage text says the skill applies to "自动化工作流场景", which materially broadens the advertised use beyond the free version's stated limits.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.