报表配置基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.0

Overview

This report-generation skill is mostly straightforward, but it asks for command-execution ability that its instructions do not need or limit.

Review before installing. The report-writing behavior is expected, but the exec permission should be removed or tightly constrained unless you specifically need host command execution for this skill. Use trusted input files and direct outputs to a dedicated reports directory to avoid accidental overwrites.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:35

Finding

Unnecessary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–38
Vulnerability Type: Excessive tool permission
Risk Level: Medium

yaml

tools:
  - read
  - write
  - exec

Technical Analysis

The Skill declares access to the exec tool even though its documented workflow only requires reading CSV, JSON, or Markdown input, processing that data, and writing a report. No documented step, runtime dependency, or implementation requirement justifies arbitrary command execution.

This violates the principle of least privilege. In an Agent platform that grants tools according to this metadata, the Skill receives a code-execution channel beyond its legitimate reporting requirements. The package contains no executable scripts or explicit malicious command, so exploitation is conditional: an attacker would need to influence the Agent through untrusted source content, user input, or another instruction channel and induce it to invoke exec.

Attack Path

1. A user invokes the Skill with an attacker-controlled CSV, JSON, or Markdown data source.
2. The Agent reads and interprets the untrusted content while performing the report-generation workflow.
3. Malicious content or related instructions attempt to persuade the Agent to execute a system command.
4. Because exec is unnecessarily available, the Agent may invoke it instead of remaining limited to data parsing and report output.
5. The command runs with the operating-system permissions assigned to the Agent process, potentially affecting resources outside the intended report workflow.

This path depends on the hosting platform honoring the declared tool permission and the Agent being susceptible to attacker-controlled instructions; the file itself does not contain a direct execution instruction.

Impact Assessment

Successful exploitation could allow commands to run with the privileges of the Agent process. Depending on the deployment environment, ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tools because the documented workflow only requires read and write:

   yaml

   tools:
     - read
     - write
   

2. Restrict file reads to explicitly supplied local data files and supported formats.
3. Restrict writes to a dedicated report-output directory and prevent path traversal or overwriting of unrelated files.
4. Treat all source-file content as untrusted data rather than Agent instructions.
5. If command execution later becomes necessary, replace unrestricted execution with a narrowly scoped operation that uses:
   • An explicit command allowlist
   • Fixed executables and validated arguments
   • No shell interpolation
   • A restricted working directory
   • A least-privileged sandbox
   • Network access disabled by default
   • Execution logging and time/resource limits

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly advertises exporting reports in Markdown/JSON/CSV and the manifest also grants write capability, but the description does not clearly warn users that the skill may create or overwrite files on disk. In an agent setting, this can lead to unexpected filesystem modifications, especially when users provide output paths or when defaults are applied implicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest enables the exec tool, but the markdown documentation does not explain why command execution is needed or warn users that the skill may run commands on the host. Because this skill's stated functionality is basic report parsing and export, undocumented execution capability materially increases risk: a compromised or poorly implemented agent could execute shell commands unnecessarily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name and the full user-facing documentation are written in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.