Security audit

Skill Salary Market Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent salary-market analysis toolkit, but users should handle web-collected data and spreadsheet exports carefully.

Install and run this in a virtual environment, pin dependencies if possible, review website terms and privacy obligations before automated collection, avoid collecting personal data unless authorized, and treat Excel/CSV outputs from web-collected data as untrusted until formula-leading values are neutralized.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/csv_to_excel.py:102
Finding: Spreadsheet Formula Injection in Excel Export
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:54
Finding: Mutable and Unverified Third-Party Dependency Installation
Content: View full analysis
=1.21.0 pandas>=1.3.0 openpyxl>=3.0.0 python-docx>=0.8.11 beautifulsoup4>=4.11.0 # 可选：Playwright 自动化 pip install playwright>=1.40.0 playwright install chromium ``` The collection guide also instructs users to install mutable dependencies: ```bash # 安装 Playwright pip install playwright playwright install chromium ``` ### Technical Analysis The installation commands specify lower bounds or no version constraint at all. They do not use a lock file, package hashes, upper bounds, or an explicitly trusted package index. Consequently, executing the documented commands at different times can install materially different package and browser versions. If a dependency release or distribution channel is compromised, or if a future release introduces an exploitable regression, users can receive code that was not part of the audited Skill. The package names observed in the project appear to be legitimate and were not identified as typosquatted packages. No malicious dependency was found in the audited artifact. The risk arises from mutable, unverified future resolution. ### Attack Path 1. A user follows the installation instructions. 2. `pip` resolves the newest package versions satisfying the broad constraints. 3. A compromised, malicious, or unexpectedly incompatible release is downloaded. 4. Package installation hooks or imported runtime code execute in the user's Python environment. 5. The dependency receives the same filesystem and process privileges as the user running the Skill. For Playwright, the separate browser installation step also downloads a mutable external browser binary without a project-level integrity manifest. ### Impact Assessment A compromised Python dependency can execute wi ...[truncated 518 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: output/深圳财务总监_20260410_report.json:4
Finding: Absolute Local Path and Workstation Username Disclosure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a comprehensive global compensation market analysis skill, but the supplied code only performs CSV-to-Excel formatting/export. Its functionality is limited to reading a CSV, creating an Excel workbook, applying styles, setting widths, freezing the header row, and enabling filtering. There is no evidence of salary analysis, currency handling, PPP adjustment, percentile computation, report writing, or recommendation generation. The code’s primary purpose is materially different from the declared purpose, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description presents a broad end-to-end global compensation market research and reporting skill. The supplied code implements only a narrow subset: multi-currency conversion, PPP adjustment, and expatriate salary package estimation, plus CSV batch processing. These align with part of the declared description, especially '多币种自动换算', 'PPP购买力平价调整', and '外派薪酬建议'. However, major claimed capabilities are absent from this chunk: there is no multi-source data acquisition, no comprehensive survey analysis workflow, no percentile computation, no 28-field template handling in any substantive sense, no professional report generation, and no multi-format export beyond CSV. Therefore the code does not accurately represent the full declared purpose and is materially narrower in scope.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive global salary market research and analysis skill, but the supplied code only performs basic CSV data cleaning. Its primary purpose is materially different: deduplication, missing-value filtering, limited salary format normalization, and outlier removal. It does not implement the core advertised capabilities such as global multi-source ingestion, currency conversion, PPP adjustment, percentile computation, professional report generation, expatriate compensation advice, or multiple output formats. Therefore the description does not accurately represent the code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a comprehensive global compensation market research capability with advanced analytics and reporting features. The supplied code only implements basic file loading from CSV/JSON, simple filtering, simple aggregate statistics, and JSON export. This is not just a partial implementation detail; the primary purpose and feature set are materially narrower than declared. There are no undeclared risky capabilities, but the description substantially overstates what the code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a comprehensive compensation market analysis skill with substantial data-processing and analytical capabilities. The actual code does not perform compensation analysis at all; it only converts Markdown text into a formatted Word document. While 'multi-format output' is loosely related to report export, this code alone is only a document rendering/export helper and lacks the core declared functionality. Therefore, the description does not accurately represent the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The description is partially aligned with the code: the implementation does support salary market data processing across domestic and overseas contexts, multi-currency conversion for more than 20 currencies, PPP adjustment, percentile calculation, and output in multiple file formats. However, several prominent declared capabilities are not implemented in this code chunk. Most notably, there is no 28-field template handling (the code explicitly says 16/24-field CSV support), no 17+ chapter professional report generation, no expatriate compensation recommendation engine, and no broad multi-format output beyond JSON/CSV. Also, 'multi-source' in the code means categorizing source labels inside already-supplied data, not collecting or merging from disparate external sources. These gaps are material enough that the declared description overstates the actual behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a global capability, but it does not offer any user language preference or indicate that Chinese is required for a region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs users to collect and process real salary-market data from many external sources, including detailed company, location, compensation, and potentially personally identifying job-posting information, but it does not provide clear privacy, legal, retention, or source-terms guidance. In HR and compensation contexts, this increases the risk of collecting personal or regulated data without adequate handling rules, leading to privacy violations, contractual breaches, or inappropriate downstream sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file instructs users to run scripts that automatically extract and export data from recruitment websites, but it does not warn that automated collection may capture personal or sensitive information from pages being viewed. Under the markdown variant of SQP-2, behaviors affecting privacy or user data should include an explicit warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The section promotes high-volume automated scraping and writing results to data.csv, and even suggests proxy use, but only mentions robots.txt and rate limiting. It omits user-facing warnings about potential collection of personal data, obligations to handle exported data safely, and the operational impact of running automation against third-party sites.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire report template is written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, this can be treated as a forced language/locale default without explicit opt-in or region-specific justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template makes a categorical trust claim that the report is based on real market data from real channels, while the file is clearly a reusable template with placeholders, fixed example coefficients, and no enforcement mechanism tying output to verified sources. This can mislead users into treating generated content as validated factual analysis even when the underlying agent may have incomplete, stale, synthetic, or unverified inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language instructions and output text that assume Chinese as the required language for all users. Under the language/locale policy, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This Python file contains user-facing documentation, CLI help text, argument descriptions, and runtime messages almost entirely in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope, and the file does not present any option to select another language or document a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language content that forces a specific language for the skill's description and usage instructions. Under the policy, language constraints should offer user opt-in or be clearly justified as region-specific, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Natural-language strings in docstrings, argparse help text, and printed status/statistics messages are all Chinese-only. There is no option for alternative language output and no documented justification for a Chinese-only locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural language and output formatting that are explicitly Chinese-only, including the top-level description and intended usage context. It also hardcodes a Chinese font later in the file, but nowhere indicates that the locale is optional or limited to a justified region-specific use case, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sets the default and East Asian fonts to '微软雅黑', enforcing a specific locale-dependent presentation in generated documents. Because no user-facing option or documented justification is provided, this is a natural-language locale policy issue rather than a functional bug.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: SQP-3 applies to all file types and covers natural-language locale policy violations. This file’s docstring, CLI help text, and output messages enforce Chinese as the interaction language, with no indication that users may choose another language or that the constraint is justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This CSV uses Chinese headers and values throughout, but provides no natural-language indication that the language/locale is optional or intentionally constrained to a China/Chinese-speaking context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file contains natural-language content exclusively in Chinese and does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The file presents all operational guidance exclusively in Chinese and does not indicate that the language is optional, selectable, or required for a region-specific purpose. Per SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains user-facing natural language exclusively in Chinese, including headings, instructions, and checklist items. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a policy issue when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: 该技能文件从标题开始即完全以中文编写，但未说明这是面向中文用户的限定文档，也未提供其他语言选项或用户选择机制。根据语言/locale 政策，若未有明确的用户选择或合理的区域限定说明，强制单一语言可能构成自然语言政策问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.