Security audit

施炜诊断方法论

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed business-diagnosis and PPT workflow, but its bundled scripts include unsafe local command execution and a hard-coded client-specific PPT output path.

Review before installing. This skill may be useful for Chinese management-consulting diagnosis, but only run its scripts in a controlled workspace, revise generate_ppt.js to remove client-specific content and accept an explicit output path, and avoid providing unredacted confidential interview, HR, financial, or leadership materials unless you trust the publisher and environment.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill advertises a business-diagnosis workflow but also directs broader local file inspection, script auditing, shell command execution, and fixed-path artifact generation. That mismatch is dangerous because users and orchestrators may grant it trust or permissions appropriate for analysis/report writing, while it can access or process unrelated local files and perform actions outside the declared scope.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Embedding Node.js and shell-based generation/audit steps expands the skill from advisory analysis into code execution and local environment interaction. Even if intended for PPT quality control, this creates a larger attack surface and can lead to unauthorized file access, environment probing, or unintended command execution in contexts that only expected document analysis.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script builds a Python command string with a file path embedded into code passed to `python3 -c` and executes it via `execSync`. If an attacker can influence the PPTX filename or path, quoting/escaping weaknesses can lead to shell command injection or unintended code execution on the host running the audit.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The script is packaged as a general-purpose management-diagnosis skill but is actually specialized to a single client and coupled to a fixed output location. In an agent context, this mismatch can cause unintended disclosure or overwriting of client-specific artifacts, because operators may trust the skill to behave generically while it silently emits a specific report to a predetermined place.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow explicitly solicits interviews, questionnaires, leadership remarks, and business/financial materials, which are likely to contain confidential corporate and personnel data. Without a clear warning, minimization rules, or handling guidance, users may disclose sensitive information unnecessarily, increasing confidentiality and privacy risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Executing a dynamically constructed shell command without explicit warning or confirmation increases the risk of unsafe use, especially in environments where file names may be attacker-controlled. While the lack of a prompt is not the root issue, it compounds the danger by making host-side code execution less visible to users.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Writing the output PPTX to a hard-coded absolute filesystem path without confirmation is dangerous because it can overwrite existing files, leak sensitive report material into an unintended workspace, or fail unpredictably depending on the runtime environment. In an agent skill, fixed-path writes are more risky because the caller may not realize where artifacts are being stored or what prior data may be replaced.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/audit_ppt.js:53