T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/csv_to_excel.py:90- Finding
Spreadsheet Formula Injection in Excel Export
- Content
View full analysis
- Remediation
View remediation
Security audit
Salary Market Analysis
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate salary-analysis toolkit, but it needs review because its web-scraping guidance is under-scoped and its Excel export can preserve unsafe spreadsheet formulas from untrusted data.
Review before installing. Use the local analysis scripts only on trusted or sanitized CSV data, neutralize spreadsheet formula characters before Excel export, and avoid automated scraping unless you have permission and have checked site terms, privacy obligations, and data-minimization requirements. Install dependencies in an isolated environment with pinned versions where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:52- Finding
Unpinned Third-Party Dependencies and Browser Components
- Content
View full analysis
=1.21.0 pandas>=1.3.0 openpyxl>=3.0.0 python-docx>=0.8.11 beautifulsoup4>=4.11.0 # Optional: Playwright automation pip install playwright>=1.40.0 playwright install chromium ``` A second unpinned installation instruction appears in `references/data-collection-guide.md`, lines 123-125: ```bash # Install Playwright pip install playwright playwright install chromium ``` ### Technical Analysis The installation instructions use open-ended minimum-version constraints or no version constraint at all. The project does not provide a lockfile, package hashes, upper version bounds, or a pinned Playwright browser revision. Consequently, two users following the same instructions at different times may install materially different code. A newly compromised, malicious, or incompatible upstream release could therefore enter the Skill's execution environment without any change to the reviewed project. The named dependencies are legitimate and consistent with the declared functionality, and the audit found no suspicious package names or custom package index. This finding concerns supply-chain integrity and reproducibility rather than evidence that the currently named packages are malicious. ### Attack Path 1. A user follows the installation commands in `SKILL.md` or the data-collection guide. 2. The package resolver queries the configured Python package index and selects any available release satisfying the open-ended constraint. 3. If a selected upstream release, transitive dependency, package-index response, or browser artifact has been compromised, the user downloads the compromised component. 4. The component is installed into the Skill's Python environment or Playwright browser cache. 5. Malicious behavior may execute during pack ...[truncated 934 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个完整的薪酬市场调研分析技能，涵盖数据采集、标准化、薪酬计算、统计分析和多格式报告生成。但提供的代码块只是一个CSV转Excel格式化工具，主要用于把已有CSV数据写入Excel并美化展示。其实际主功能与声明范围相比明显更窄，且缺少声明中的核心分析与报告能力。因此描述不能准确代表该代码块实际行为，属于明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个较完整的薪酬市场调研分析技能，重点在数据采集、标准化建模、统计分析和报告输出。而提供的代码块只覆盖数据清洗环节，且范围较窄：输入输出都是CSV文件，没有网络采集、多源整合、分位值统计、报告生成或多格式导出能力。虽然薪酬标准化与异常值处理可视为分析流程中的辅助步骤，但不足以支撑所宣称的核心功能，因此描述与实际行为存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个功能完整、增强版的薪酬市场调研分析技能，核心能力应包括标准化模板处理、薪酬计算、分位分析、专业报告生成和多格式导出。但提供的代码仅实现了基础数据加载、简单筛选、按岗位计数的统计，以及JSON导出。这不是少量实现细节缺失，而是主要能力与声明大范围不一致，且实际主用途明显比声明更基础、更窄。因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码与声明的核心用途明显不一致。声明描述的是薪酬市场调研分析与报告生成类技能，包含数据采集、标准化、薪酬统计计算和多格式导出等分析型能力；而实际代码只是一个独立的 Markdown 转 Word 脚本，不涉及薪酬数据、统计分析、CSV模板、报告章节生成或 Excel 输出。虽然“Word 输出”与声明中的一项导出形式有部分重叠，但这只是声明中很小的一个子能力，且代码没有体现与薪酬调研分析相关的主流程，因此应判定为明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该技能的总体领域仍是薪酬数据分析，但声明中的多项核心能力与代码行为不符，且这些差异属于主要功能层面的不一致，而非实现细节。代码确实实现了多源分类、年薪自动计算、企业类型/地区/经验/学历统计和质量评分等分析能力，但缺少声明中强调的数据收集、24字段模板、P10/P20分位值、17章节报告及Excel/Markdown/Word输出。因此应判定为描述与实际行为存在实质性不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly encourages collecting salary data from websites, forums, OCR, browser extensions, and Playwright automation, yet it omits safeguards about privacy, terms-of-service restrictions, consent, and secure handling of potentially personal or employer-sensitive data. In an HR/pay context, scraped records can contain links, company names, locations, benefits, and other identifying details, increasing legal, compliance, and privacy exposure even if the intent is legitimate market research.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Tampermonkey workflow instructs users to automatically extract data from recruiting websites without disclosing that such extraction can capture personal data, may violate platform terms, and can expose users to account or legal risk. Because this is presented as a practical collection method in a salary research skill, the omission materially increases the chance of improper data collection.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Playwright section gives operational instructions for large-scale scraping, including use of proxies to avoid IP blocks, but does not clearly warn about legal, privacy, terms-of-service, or account-risk consequences. In this skill context, that omission makes unsafe automation more likely because users are being guided to collect data from third-party recruiting sites at scale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown template is entirely written as a Chinese report format and does not indicate that another language or locale can be selected. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The template makes a blanket factual claim that all report data comes from real channels, but the file is only a generic report scaffold and cannot enforce that claim. If generated reports inherit this statement without provenance checks, users may be misled into trusting fabricated, stale, or synthetic compensation data as verified market evidence.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings entirely in Chinese in the module docstring, argparse help text, worksheet title, and console messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language instructions and descriptions exclusively in Chinese, including the module docstring and later command-line help text. That enforces a language/locale choice on users without documenting an opt-in or offering alternatives, which matches the language-policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The argparse description and argument help strings are user-facing natural-language content, and they are only provided in Chinese. Because the skill does not offer a language choice or explain a justified locale restriction, this is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings exclusively in Chinese in the module docstring and CLI help context, which effectively constrains the skill to a specific language. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified region-specific limitation, neither of which is present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes multi-source data collection, 24-field CSV normalization, annual salary calculation, percentile computation (P10-P90), 17-section report generation, and multi-format output including Excel/Markdown/Word. In this file, the code only loads CSV/JSON, counts positions/sources, filters by location/level, and optionally exports JSON, so the actual behavior does not match the stated skill description.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
模块文档明确写明只处理 16 字段模板，且分位值实现默认为 P30-P90；这与技能清单描述中的 24 字段标准化 CSV 模板和 P10-P90 分位值计算存在直接能力差异。该问题属于技能描述与实际代码实现范围不一致。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language interface, usage text, and runtime-facing descriptions are entirely in Chinese, with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill implicitly requires one language without opt-in or documented regional justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
技能清单描述宣称支持 Excel、Markdown、Word 多格式输出以及 17 章节专业报告生成，但本文件的报告生成与保存逻辑仅构造一个 JSON 报告对象，并在保存时输出 JSON/CSV 两种文件。该偏差说明实际实现能力明显低于对外宣称的功能范围。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This CSV uses Chinese-only headers and values throughout, which imposes a specific language/locale on consumers of the skill artifact. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation, and no opt-in or justification is present in the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON report contains numerous natural-language field values and labels in Chinese, such as source categories, locations, job titles, and statistical descriptors. Because the file provides no indication that Chinese output is optional, user-selected, or justified as a region-specific requirement, it may violate the language/locale policy described for natural-language content.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The dataset content is entirely in Chinese and specifically scoped to Shenzhen job market data, with no indication that language or locale selection is optional. For an AI skill artifact, this can be a natural-language locale constraint that is not documented as user-selectable or explicitly justified within the file.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
All user-facing instructions in the file are presented only in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains natural-language guidance exclusively in Chinese and does not provide an opt-in, alternative language, or justification for the locale restriction. Under the language/locale policy rule, forcing a specific language without user choice can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all methodology guidance exclusively in Chinese, and there is no indication that the user can choose another language or that the locale restriction is intentional and documented. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.