T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/apply.py:133- Finding
Spreadsheet Formula Injection in Generated Comparison Workbooks
- Content
View full analysis
- Remediation
View remediation
Security audit
Deck Pipeline
Security checks for vulnerabilities and agentic risk
Overview
The skill largely does what it claims, but its generated Excel audit files can contain active formulas from untrusted deck text.
Review before installing if you process decks from outside your organization. Until formula escaping is fixed, open generated XLSX files in protected mode and treat source decks/edit JSON as trusted input. Install from a verified repository in a virtual environment with pinned dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
README.md:38- Finding
Unpinned Third-Party Dependencies and Unresolved Installation Source
- Content
View full analysis
/deck-pipeline ~/.claude/skills/deck-pipeline pip3 install python-pptx openpyxl pymupdf pyyaml ``` ### Technical Analysis The installation instructions request third-party packages without exact versions or cryptographic hashes. Each installation can therefore resolve to different package releases. A future compromised, malicious, or incompatible release would be installed and imported with the privileges of the user running the Skill. The Git repository address also contains the unresolved placeholder ``. This prevents users from reliably verifying the intended source and may encourage substitution with an unofficial repository. The audited project does not itself retrieve or execute a remote payload at runtime; this finding concerns the documented installation process and its supply-chain controls. ### Attack Path 1. A user follows the README installation instructions. 2. The user substitutes an unofficial repository for the unresolved placeholder, or pip resolves the latest available package versions. 3. A substituted repository or dependency release contains malicious installation or import-time code. 4. The code executes under the account running `git`, `pip`, or the Skill when the package is installed or imported. This path requires compromise or substitution of an upstream source; no such compromise was demonstrated in the audited files. ### Impact Assessment If an upstream package or substituted repository were malicious, its code could execute with the privileges of the installing user. That could potentially expose presentation contents and other files accessible to that account or modify the local environment. The project does not request administrative installation, and no privilege-escalation mechanism was found. Th ...[truncated 180 chars]- Remediation
View remediation
--hash=sha256: openpyxl== --hash=sha256: PyMuPDF== --hash=sha256: PyYAML== --hash=sha256: ``` 4. Instruct users to install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 5. Use an isolated virtual environment rather than installing into the global Python environment. 6. Add an automated dependency audit and a controlled update process so pinned versions are regularly reviewed and patched. 7. Pin the repository clone to a signed release tag or documented commit and publish checksum or signature-verification instructions. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The finding indicates the skill may actually center on style analysis/distillation, including PDF inputs, rather than the deck transformation system described. While not a classic exploit path, this mismatch can still expose users to process integrity issues and unintended data-sharing expectations for unsupported file types and workflows.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README states that 'McKinsey is the default baseline' and that additional references are layered on top of that base, which imposes a specific organizational language/style policy by default. This is a natural-language policy concern because users are not presented with an explicit opt-in or neutral default before the style constraint is applied.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly describes writing .pptx, .xlsx, and HANDOFF.md files, but it does not declare a constrained tool scope such as permissions or allowed-tools. In an agent setting, missing tool scoping broadens what the skill may cause the runtime to do and weakens least-privilege controls around file modification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description says the system takes decks from a Chinese draft to "McKinsey-polished English" and describes polish-only as applying to single-language decks, but it does not offer the user any language/locale choice or explain why English is mandatory. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The changelog describes a "Polish-only mode for single-language decks," which is a natural-language locale constraint. In this file, there is no indication that the mode is user-selected or that the locale restriction is documented as justified, so it may conflict with the policy against forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The default output name appends the fixed suffix '终版', imposing a specific locale in a user-visible artifact without offering a language choice. This is a natural-language policy concern because the skill does not provide opt-in or document a justified locale restriction.
- Content
Static analysis
No suspicious patterns detected.