T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:285- Finding
Skill Instructions Mandate Unconditional Transfer of Sensitive Payroll Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Payroll Data Audit
Security checks for vulnerabilities and agentic risk
Overview
This payroll-audit skill has real audit functionality, but it also mandates cloud delivery of sensitive payroll outputs and ships generated payroll artifacts and Feishu links, so it requires careful review before installation.
Review before installing. Do not use this skill with real payroll data unless generated sample outputs and cloud links are removed, Feishu delivery is made explicit opt-in with destination and recipient confirmation, lark-cli execution is changed to safe argument-based subprocess calls, and HTML/report output escapes all payroll-derived fields.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deliver_to_feishu.py:29- Finding
Arbitrary Shell Command Execution Through User-Controlled Output Paths
- Content
View full analysis
dict: """Run a shell command and return {ok, stdout, stderr}""" result = subprocess.run( cmd, shell=True, cwd=cwd, capture_output=True, text=True, timeout=120 ) try: data = json.loads(result.stdout.strip()) return {"ok": result.returncode == 0, "data": data, "stderr": result.stderr} except json.JSONDecodeError: return {"ok": result.returncode == 0, "output": result.stdout, "stderr": result.stderr} def upload_file_to_drive(file_path: str, name: str) -> dict: """Upload a file to Feishu Drive root folder""" abs_path = os.path.abspath(file_path) file_dir = os.path.dirname(abs_path) file_name = os.path.basename(abs_path) cmd = f'cd "{file_dir}" && lark-cli drive +upload --file "./{file_name}" --name "{name}" --as user' result = run_cmd(cmd) if result["ok"] and "data" in result: return { "filename": name, "ok": True, "file_token": result["data"].get("data", {}).get("file_token", ""), "url": result["data"].get("data", {}).get("url", ""), "size": result["data"].get("data", {}).get("size", 0), } return {"filename": name, "ok": False, "error": result.get("output") or result.get("stderr")} def import_as_docx(file_path: str, name: str) -> dict: """Import a .md file as a Feishu docx document""" abs_path = os.path.abspath(file_path) file_dir = os.path.dirname(abs_path) file_name = os.path.basename(abs_path) cmd = f'cd "{file_dir}" && lark-cli drive +import --file "./{file_name}" --name "{name}" --type docx --as user' result = run_cmd(cmd) ``` ### Technical Analysis The script builds shell command strings using filesystem paths derived from the user-co ...[truncated 2355 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_report_v6.py:554- Finding
Stored Cross-Site Scripting in Generated Payroll Reports and Interactive Dashboards
- Content
View full analysis
🔴 [{category}] {name} ({rid}) — {triggered}人异常 """) for d in details[:30]: emp_id = d.get("工号", "") emp_name = d.get("姓名代号", "") val = d.get("value", d.get("diff", "")) expected = d.get("expected", "") idx = d.get("index", "") detail_href = "" if link_template and emp_id: detail_href = link_template.replace("{emp_id}", emp_id).replace("{emp_name}", emp_name).replace("{row_index}", str(idx)) detail_link = f'🔗' if detail_href else "" tag_class = "person-tag" if color_tag == "red" else "person-tag yellow" html_parts.append(f"""""") ``` Dynamic dashboard generation: ```javascript r.details.forEach(d => { const empId = d['工号'] || d['emp_id'] || ''; const empName = d['姓名代号'] || d['name'] || ''; const val = d['value'] || d['diff'] || ''; const expected = d['expected'] || ''; const note = d['note'] || d['reason'] || ''; html += ``; }); html += `
`; tbody.innerHTML = html; ``` ### Technical Analysis Values originating from payroll data and audit-result JSON are inserted directly into HTML witho ...[truncated 2592 chars]工号 姓名 异常值 预期值 详情 {emp_id} {emp_name} {val} {expected} {detail_link} ${empId} ${empName} ${val} ${expected} ${note} - Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
_delivery/01_audit_result.json:1- Finding
Employee-Level Payroll Artifacts and Live Cloud References Included in the Distributed Package
- Content
View full analysis
", "uploaded_files": [ { "file_token": "", "url": "https://didatravel.feishu.cn/file/" } ] } ``` The placeholders above redact live-looking object tokens observed in the audited package. ### Technical Analysis The distributed project contains generated audit artifacts rather than only source code and synthetic test fixtures. The artifacts include employee-level audit details for 947 records, audit exceptions, aggregate payroll information, delivery metadata, and Feishu object references. Although employee names appear pseudonymized, pseudonymous identifiers remain sensitive when they can be correlated with internal employee data. The detailed exception records may reveal employment, attendance, compensation, benefits, or compliance information. The same material appears in seve ...[truncated 1725 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (126)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to perform payroll auditing but also documents uploading local files to Feishu, invoking external CLI tooling, creating online documents, and generating outbound delivery artifacts. In a payroll setting, undisclosed remote-transfer capability is highly sensitive because it can exfiltrate salary data, reports, and employee identifiers to third-party systems.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 第七步：审核清单看板 | `generate_kanban.py` / `generate_kanban_v6.py` | 静态看板（v5）/ 动态交互看板（v6） |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 第七步：审核清单看板 | `generate_kanban.py` / `generate_kanban_v6.py` | 静态看板（v5）/ 动态交互看板（v6） |
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes remote collaboration capability to upload files to Feishu cloud storage and create Feishu documents, but that capability is not justified by the core need to audit payroll data. Because payroll artifacts contain sensitive personal and financial information, unnecessary remote transfer materially raises the risk of data exfiltration, oversharing, and regulatory noncompliance.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation states that red-line findings must block later steps and prevent report generation, yet elsewhere says the full pipeline always generates all outputs and mandates delivery afterward. In a payroll workflow, this contradiction is dangerous because severe anomalies may still propagate into reports and external delivery, leaking or legitimizing incorrect salary data despite the supposed safety gate.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs automatic upload of audit files and Feishu delivery without a clear user-facing warning that the payload may contain sensitive payroll information, including employee identifiers and compensation data. In this context, silent or under-warned transmission of payroll artifacts is especially dangerous because it can violate confidentiality obligations and cause large-scale privacy exposure.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This script has a capability boundary issue: it does more than analyze payroll data by invoking an external CLI to upload files and create remote documents. In the context of a payroll audit skill, that remote-write capability is especially sensitive because it can transfer confidential audit outputs outside the local environment without strong guardrails.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This is a concrete tool-parameter abuse risk because shell=True delegates parsing to the shell while the command string is dynamically assembled elsewhere in the file. If an attacker can influence filenames, directory names, or other interpolated values, they may inject additional shell syntax and execute unintended commands under the privileges of the audit process.
- Content
python def run_cmd(cmd: str, cwd: str = None) -> dict: """Run a shell command and return {ok, stdout, stderr}""" result = subprocess.run( cmd, shell=True, cwd=cwd, capture_output=True, text=True, timeout=120 )
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all headings, labels, and conclusions in Chinese only, with no indication that the user can choose another language or that the report is intentionally region-specific.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents shell execution plus file read/write behavior but declares no explicit tool scope or permission boundaries. In a payroll context, that creates unnecessary ambiguity about what the agent may access or modify, increasing the risk of over-broad file access or command execution against sensitive HR data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The manifest and instructions rely heavily on Chinese-language triggers and require the user to reply with the specific phrase '确认无误' to proceed. Without stating that equivalent confirmations in other languages are accepted, this can amount to an implicit language constraint rather than an opt-in locale choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly frames itself as a payroll-audit system yet makes Feishu delivery a required operational step. In a payroll context, forcing external delivery expands handling of highly sensitive employee compensation data beyond the minimum necessary function and can cause unintended disclosure or compliance violations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The JSON reports large blue-line trigger counts and detailed affected records, but the embedded judgment metadata simultaneously says triggered=0 and verdict='通过'. In a payroll-audit skill, this kind of contradictory result data can suppress or misrepresent anomalies, causing downstream agents or reviewers to treat materially abnormal payroll changes as cleared when they are not.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The report footer states 'payroll-data-audit v5.1' while the skill metadata claims v7.2 and the page header shows rule version 7.0.0, creating materially inconsistent provenance for a payroll audit artifact. In a payroll/compliance workflow, version mismatch can mislead reviewers about which rules and fixes were applied, undermine traceability, and cause approval decisions to rely on an outdated or misrepresented audit basis.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains user-facing natural-language content exclusively in Chinese, from the title through all report sections. Under the policy criteria, forcing a specific language without user opt-in or a documented justification is a locale-policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document declares
lang="zh-CN", which explicitly fixes the report to a specific language/locale. Under the policy, forcing a locale without user opt-in or a documented region-specific justification is a natural-language policy violation.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The report explicitly states '禁止出报告' while simultaneously existing as a generated deliverable, which creates a dangerous integrity failure in a payroll-control workflow. In this skill context, the contradiction is more severe because payroll audit reports are decision artifacts; a blocked report being emitted anyway can cause unauthorized payroll release or false sign-off.
- Content
Static analysis
No suspicious patterns detected.