台灣房價估價分析 (Property Valuation)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

The valuation tool itself is coherent, but it tells agents to run an unbundled local analytics script with unclear privacy and execution boundaries.

Install only if you are comfortable with the analytics behavior or can disable/ignore it. The core valuation calculator is straightforward, but agents should not automatically run `skills/analytics.py` unless the platform-provided script, collected data, and storage destination are known and trusted. Treat generated Markdown reports as untrusted if property data can come from someone else.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Execution of an Unbundled and Unverified Analytics Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57–65
Vulnerability Type: Unverified local dependency execution
Risk Level: Medium

Vulnerable Code

markdown

## 📊 Usage Analytics

當你使用此 Skill 完成任務後，請記錄使用次數：

```bash
python3 skills/analytics.py taiwan-property-valuation used

查看統計：

bash

python3 skills/analytics.py stats

text

### Technical Analysis

The Skill instructs the agent to execute `skills/analytics.py` after completing a valuation task. That script is not included in the audited project, so its implementation, provenance, integrity, and side effects cannot be verified.

Because the command uses a relative path, the file that is executed depends on the process's working directory. An attacker who can create or replace `skills/analytics.py` in that directory can cause arbitrary Python code to run under the identity of the agent or user invoking the Skill.

This resembles an insecure dependency or supply-chain trust issue: the Skill relies on an external local component without pinning its location, validating its integrity, or documenting its required behavior. The analytics operation is also not necessary for the core property-valuation function.

### Attack Path

1. An attacker gains the ability to place or modify a file at `skills/analytics.py` in the agent's effective working directory.
2. The attacker inserts arbitrary Python instructions into that file.
3. A user invokes the property-valuation Skill.
4. The agent follows the post-task analytics instruction and runs:
   `python3 skills/analytics.py taiwan-property-valuation used`.
5. Python executes the attacker-controlled file with the invoking process's permissions.
6. The malicious script can access data and resources available to that account, including local files, environment variables, and network services permitted by the runtime.

Exploitation requires the attacker to influence the referenced rela
...[truncated 669 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the analytics commands if telemetry is not essential to property valuation.
2. Make analytics explicitly opt-in rather than instructing the agent to execute it after every completed task.
3. If analytics is required, include its implementation in the audited package and review it with the rest of the Skill.
4. Resolve the script from a trusted, canonical package location rather than from the current working directory.
5. Verify the script's cryptographic digest or signed package provenance before execution.
6. Run analytics in a restricted process with no access to confidential files, credentials, or unnecessary network destinations.
7. Document exactly what information is collected, where it is stored or transmitted, and how users can disable collection.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/calc-valuation.py:146

Finding

Markdown Injection Through Unescaped Property Data

Content

View full analysis

Vulnerability Details

File Location: scripts/calc-valuation.py, lines 146–163
Vulnerability Type: Markdown and report-content injection
Risk Level: Low

Vulnerable Code

python

    # Comp table
    comp_lines = []
    for c in result.get('comp_analysis', []):
        comp_lines.append(f"- {c['address']} → {c['total_price']:,} 元（{c['unit_price']:,} 元/坪）")
    comp_text = '\n'.join(comp_lines) if comp_lines else '無參考對象'

    report = f"""# 📊 不動產估值分析報告

## 物件基本資料

| 項目 | 內容 |
|------|------|
| 地址 | {prop.get('address', '—')} |
| 總坪數 | {prop.get('total_area', '—')} 坪 |
| 屋齡 | {prop.get('building_age', '—')} 年 |
| 樓層 | {prop.get('floor', '—')}F / {prop.get('total_floors', '—')}F |
| 類型 | {prop.get('type', '—')} |

Technical Analysis

The report generator interpolates property fields and comparable-property addresses directly into a Markdown document without context-aware escaping. At minimum, property.address, property.type, and each comparable address can contain arbitrary strings from the input JSON.

Markdown control characters, line breaks, raw HTML, links, and image syntax remain active after interpolation. A crafted address can terminate a table row, create new headings, insert deceptive valuation statements, add external links, or embed a remote image. Some Markdown viewers retrieve remote image resources automatically, potentially disclosing the viewer's IP address and request metadata to an attacker-controlled server.

This issue does not result in code execution in the Python process itself. Its practical effect depends on the security behavior of the application used to render or convert the generated Markdown. Renderers that permit raw HTML or unsafe URL schemes can increase the impact.

Attack Path

1. An attacker supplies or influences the valuation input JSON.
2. The attacker places Markdown syntax or raw HTML in an address or other interpolated text field. ...[truncated 1409 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply context-aware Markdown escaping to every user-controlled text field before interpolation.
2. Escape at least backslashes, pipes, brackets, parentheses, angle brackets, formatting markers, and line breaks where appropriate for the destination context.
3. Reject or normalize carriage returns and line feeds in values intended for a single Markdown table cell.
4. Disable raw HTML and remote-resource loading in the recommended Markdown renderer.
5. Permit only safe URL schemes if future report fields intentionally support links.
6. Validate numeric fields separately and reject booleans, non-finite values, strings, and values outside reasonable valuation ranges.
7. Prefer a report-generation library or templating system that supports destination-aware escaping rather than constructing Markdown through unrestricted string interpolation.
8. Add tests containing table separators, headings, links, images, raw HTML, and multiline values to verify that all supplied data remains literal text.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs running local Python scripts and enables analytics metadata, but it does not declare any explicit tool scope or permissions boundaries. This creates an unnecessary trust gap: an agent or user may execute file-reading and file-writing operations without clear least-privilege constraints, increasing the chance of unintended local file access or modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to record usage analytics and notes that installation counts are automatically tracked, but it does not provide a clear warning, consent flow, or explanation of what data is collected and where it is sent or stored. This is dangerous because it can result in covert or poorly understood telemetry collection, especially in professional workflows that may involve sensitive client or regional activity patterns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code emits all user-facing report content, console messages, and usage text in Chinese, and the sample input also assumes Chinese/Taiwanese address formats. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The natural-language instructions and labels are predominantly in Chinese, and the skill is specialized for Taiwan real estate. While the regional scope may be justified, the file does not explicitly offer users a language choice or state that the Chinese-language interaction is intentional and expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill's documented behavior expands beyond property valuation by directing users to run usage analytics commands. Even if the analytics are not inherently malicious, this is a scope expansion that introduces extra execution paths unrelated to the stated business function and can normalize collecting metadata without necessity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The analytics-tracking capability is not required to estimate property values, compare listings, or generate valuation reports. Unjustified telemetry increases attack surface and may expose usage patterns or user activity for no valuation-related benefit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown content is written entirely in Traditional Chinese and the title provides no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The entire skill content is written only in Traditional Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or Taiwan-specific audience. Under the policy rule for language/locale, this can be interpreted as forcing a specific language without explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill content is entirely written in Traditional Chinese and is explicitly scoped to Taiwan real-estate practices, beginning with a Chinese-only title. There is no indication that users may choose another language or locale, which can conflict with a language/locale policy requiring opt-in or choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown content forces a single language presentation without any user opt-in, fallback, or justification that the skill is region-specific, which can conflict with organizational language-choice requirements.

Content

No source excerpt is available for this finding.