Security audit

Research Company

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says by researching a company and generating a PDF, with ordinary caution needed for package installation and local report files.

Before installing, prefer using a pinned or preinstalled ReportLab dependency, review where the temp JSON and final PDF will be written, clean up sensitive research data after use, and verify important claims or links in generated reports before relying on them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:54
Finding: Unpinned Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` 2. Install dependencies with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Lock and review all transitive dependencies rather than pinning only the top-level package. 4. Use a trusted or internally mirrored package index. 5. Install inside an isolated virtual environment or container with minimal filesystem and network permissions. 6. Avoid performing package installation automatically during normal Skill execution. Prepare and verify the runtime environment before invoking the Skill. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_report.py:137
Finding: Untrusted Research Data Is Interpreted as ReportLab Paragraph Markup
Content: View full analysis
ACCOUNT RESEARCH REPORT', styles['Normal'])], [Paragraph(f'{company}', styles['Normal'])], [Spacer(1, 8)], [Paragraph(f'Date: {date} | Source: {url} | Analyst: Claude AI', styles['Normal'])] ] ``` Titles and descriptions are also passed directly to the markup parser: ```python def create_bordered_item(title, description, accent_color, styles): """Create a left-bordered item block.""" content = [] if title: content.append([Paragraph(f'{title}', styles['ItemTitle'])]) if description: content.append([Paragraph(description, styles['ItemDesc'])]) ``` Additional direct sinks include: ```python story.append(Paragraph(data['executive_summary'], styles['ReportBody'])) ``` ```python story.append(Paragraph(data['target_market']['segments'], styles['ReportBody'])) ``` ```python story.append(Paragraph(data['target_market']['business_model'], styles['ReportBody'])) ``` ### Technical Analysis ReportLab's `Paragraph` accepts XML-like formatting syntax. The generator supplies externally derived JSON strings directly to this parser without XML escaping, tag allowlisting, schema vali ...[truncated 2313 chars]
Remediation: View remediation
{safe_company}', styles['Normal'] ) ``` 3. Apply escaping consistently to all fields, including descriptions, summaries, competitors, trends, keywords, profile values, and footer data. 4. If limited markup is a required feature, implement an explicit allowlist of permitted tags and attributes rather than accepting arbitrary ReportLab markup. 5. Reject link and resource-loading constructs unless they are explicitly required and validated. 6. Validate the JSON against a machine-enforced schema before rendering: - Require expected object, array, and string types. - Set maximum lengths for strings and arrays. - Reject unexpected nested structures. 7. Catch ReportLab parsing and rendering exceptions and return a controlled error without leaving a misleading or partial output file. 8. Add regression tests using unbalanced tags, entity characters, injected links, deeply nested markup, and oversized strings. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill instructs the agent to read local files such as scripts/generate_report.py and references/data-schema.md, but it does not declare any explicit tool scope or permissions. Missing scope declarations can cause overbroad tool access or ambiguous enforcement, increasing the chance that an agent with broader-than-expected filesystem access reads unintended files in the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The workflow writes JSON to /tmp and generates a PDF in the workspace without warning the user that local filesystem changes will occur. While expected for a report-generation skill, silent file creation can still surprise users, leave residual sensitive research artifacts on disk, or overwrite existing files if paths are reused carelessly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.