报告工具包-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This reporting skill is mostly coherent, but it gives agents broad read, write, command execution, file, email, and network behaviors without enough scoping or confirmation controls.

Review before installing. Use this only with trusted report configurations, least-privilege API and SMTP credentials, and user-approved recipients and URLs. Avoid enabling command-based sources or arbitrary file paths unless you can constrain them to known safe collectors and approved report-input directories.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:140

Finding

Unrestricted Shell Command Data Source Enables Arbitrary Command Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 140-141
Vulnerability Type: Unrestricted command execution
Risk Level: High

Vulnerable Code

yaml

- type: command
  command: "df -h"

The same command-source pattern is documented again at SKILL.md:210-211.

Technical Analysis

The Skill declares access to the exec tool and defines a report data-source type whose command property contains a shell command. The documentation does not impose a command allowlist, structured argument model, shell-metacharacter validation, fixed executable mapping, sandbox, restricted working directory, or user-confirmation requirement.

Consequently, an attacker who can supply or modify report configuration could replace the demonstrated df -h value with another command. If the Agent follows the Skill and passes that value to a shell or equivalent execution tool, the value becomes an arbitrary command-execution primitive.

This is particularly dangerous when report definitions originate from untrusted project content, generated input, or user-provided configuration. Shell operators, substitutions, redirections, and pipelines could also combine data collection with system modification or disclosure.

Attack Path

1. An attacker creates or modifies a report configuration.
2. The attacker sets sources[].type to command.
3. The attacker replaces the documented command with an attacker-controlled shell expression.
4. The user or scheduler triggers report generation.
5. The Agent interprets the source and invokes its declared exec capability.
6. The command executes with the operating-system privileges of the Agent process.
7. The attacker may read files, modify project content, invoke network utilities, or execute additional locally available programs.

Impact Assessment

Successful exploitation permits command execution under the Agent's account. The accessible scope may include the cur ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

• Remove generic command-based data sources unless they are indispensable.
• Replace free-form command strings with a fixed allowlist of collectors, such as a dedicated disk_usage operation mapped internally to a known executable.
• Pass arguments as structured arrays directly to a process API without invoking a shell.
• Reject shell metacharacters, command substitutions, redirections, pipelines, and multiline values.
• Execute approved collectors in a sandbox with minimal filesystem and network access.
• Use a fixed working directory and a sanitized environment that excludes unrelated credentials.
• Apply execution timeouts, output-size limits, and resource limits.
• Require explicit user confirmation before enabling or changing any command-based source.
• Log the normalized executable and arguments before execution.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:212

Finding

Arbitrary Local File Paths Can Expose Sensitive Host Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 212-213
Vulnerability Type: Unrestricted local-file access
Risk Level: High

Vulnerable Code

yaml

- type: file             # File data source
  path: "/path/to/data.json"

Technical Analysis

The Skill requests the read tool and permits a file data source to specify an absolute path. It does not define an authorized data root, path canonicalization procedure, traversal protection, symlink policy, file-type restriction, or sensitive-path denylist.

An attacker-controlled report configuration could therefore identify any file readable by the Agent process. The file's contents would enter the report-processing context and could subsequently be included in generated output or transmitted through another configured delivery channel.

Absolute paths are explicitly demonstrated. Relative traversal sequences and symlinks could present additional bypass opportunities if an implementation performs only superficial prefix checks.

Attack Path

1. An attacker creates or modifies a report configuration.
2. The attacker selects the file source type.
3. The attacker sets path to a sensitive file accessible to the Agent.
4. The user or scheduler starts report generation.
5. The Agent uses its declared read capability to load the selected file.
6. The file contents are processed as report data.
7. The contents may appear in chat, a generated report, email, or another configured destination.

Impact Assessment

Exploitation could disclose source code, private configuration, environment files, API credentials stored on disk, SSH material, Agent state, report history, or other files readable by the Agent account.

The vulnerability does not bypass operating-system permissions by itself. Its scope is limited to files already accessible to the Agent, but it exposes that access to report configuration without demonstrating a legitimate nee ...[truncated 28 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict file sources to a dedicated report-input directory.
• Resolve and canonicalize every path before access, then verify that it remains beneath the authorized root.
• Reject absolute paths and traversal components such as ...
• Reject symlinks or verify the canonical target after resolving every symlink.
• Deny access to credential files, private keys, environment files, system directories, Agent state, and hidden configuration directories.
• Permit only necessary file types and enforce file-size limits.
• Require explicit user approval when a report adds or changes a file source.
• Separate file-reading and external-delivery permissions so reading local data does not automatically authorize transmission.
• Redact secrets before including source content in logs or generated reports.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89

Finding

Unrestricted Callback and Data-Source URLs Enable SSRF and Data Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 89
Vulnerability Type: Unvalidated outbound destination
Risk Level: High

Vulnerable Code

markdown

| callback_url | string | Optional | Callback notification URL after asynchronous processing completes |

Related report configuration at SKILL.md:202-216 also permits configurable API and delivery destinations:

yaml

sources:
  - type: api
    url: "https://..."
    env: API_KEY
    params:
      key: value
  - type: command
    command: "df -h"
  - type: file
    path: "/path/to/data.json"
format: markdown
delivery: file

Technical Analysis

The Skill accepts a callback URL and configurable API source URLs but specifies no URL validation or outbound-network security controls. There are no documented restrictions on schemes, destinations, resolved IP addresses, redirects, ports, DNS rebinding, loopback addresses, private networks, link-local ranges, or cloud metadata services.

The callback payload is not defined, and the Skill also supports local files, commands, email, chat, and generated reports. Without explicit data-flow controls, sensitive report content or execution metadata may be sent to an attacker-controlled endpoint.

User-controlled source URLs can produce server-side request forgery when the Agent performs requests from a more privileged network position. A destination that initially appears public may also redirect or resolve to an internal address unless validation is repeated after DNS resolution and for every redirect.

Attack Path

1. An attacker supplies a report input containing a malicious API URL or callback_url.
2. The URL targets an internal service, loopback listener, link-local service, cloud metadata endpoint, or attacker-controlled external server.
3. The Agent processes the report using its network-access capability.
4. The Agent sends a request from the host's trusted networ ...[truncated 924 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only HTTPS URLs with explicit, approved destination hosts.
• Reject embedded credentials, unusual ports, non-HTTP schemes, and malformed host representations.
• Resolve hostnames before connecting and block loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
• Revalidate the destination after every redirect and limit or disable redirects.
• Protect against DNS rebinding by binding validation to the actual connection address.
• Use an outbound proxy or firewall allowlist to enforce destination restrictions independently of Skill instructions.
• Define a minimal callback schema that excludes report contents, credentials, raw source responses, and verbose logs by default.
• Require explicit user confirmation before sending data to a new callback, email address, or other external destination.
• Apply secret detection and redaction before delivery.
• Keep network-fetch permission separate from local-file and command-execution permissions to prevent straightforward data-exfiltration chains.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill supports saving reports to local files and sending them by email, but it does not present a prominent warning that generated content may contain sensitive data and will leave the immediate chat context. For a reporting tool that aggregates external and local sources, silent persistence and transmission materially increase data exposure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guidance says users can trigger the scenario with natural-language instructions and the tool will automatically execute the corresponding operation, but it does not define clear boundaries or approval requirements. In combination with read, write, and exec permissions, this can lead to overbroad invocation and unintended actions based on loosely phrased prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

schedule: "0 9 * * 1"  # 每周一 9 点
sources:
  - type: api
    url: "https://api.stripe.com/v1/balance"
    env: STRIPE_API_KEY  # 环境变量引用
format: markdown
delivery: file

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly supports a command data source and provides command: "df -h" as an example, which normalizes shell execution inside a reporting tool. In an agent context with exec capability, this broadens the skill from report generation to arbitrary command execution, creating a path for command injection, unsafe expansion of user-controlled config, or misuse to access local system data far beyond the stated purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions say the skill should be used for database operations, SQL queries, and storage management, which conflicts with the rest of the document describing a reporting tool. This ambiguity can cause an agent to invoke the skill outside its intended scope, increasing the chance of unnecessary file access, command execution, or secret use in unrelated tasks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill states that API keys are referenced via environment variables and not stored in configuration files. However, the examples later show export commands using real secret variable names in the skill file itself, which weakens the stated separation between configuration and secret handling and contradicts the strict 'not stored in config' messaging in the documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The skill explains that API keys are provided through environment variables, but it does not warn users that enabling external APIs and SMTP credentials exposes the skill to sensitive secrets and may allow outbound access to third-party services. For a markdown skill description, this is a missing disclosure about privacy and system-integrity implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.