grpc-test-automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:05 AM UTC
• Version: 1.0.0

Overview

This skill matches its gRPC testing purpose, but it includes under-scoped board deployment patterns, unauthenticated network services, and automatic package installation that users should review before installing.

Install only if you will use it in an isolated lab environment. Review and harden the generated network services before exposing them, avoid running the pip-installing scripts in a privileged or shared environment, validate project paths, and treat generated Excel reports as containing untrusted test data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_report.py:13

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

/dev/null || true echo "✅ Dependencies checked" ``` ### Technical Analysis Both scripts install Python packages at runtime without version constraints, cryptographic hashes, an explicitly trusted package index, or an isolated virtual environment. Consequently, the effective code installed and executed can change after the Skill has been reviewed. Python package installation may execute package build logic under the privileges of the user running the Skill. The initializer also suppresses error output and ignores installation failures through `2>/dev/null || true`, making package substitution, resolver problems, and integrity failures more difficult to detect. This is an unsafe supply-chain pattern even though no specific malicious dependency is embedded in the repository. ### Attack Path 1. A user runs `scripts/init_project.sh`, or invokes `scripts/generate_report.py` on a system where `openpyxl` is unavailable. 2. The script invokes `pip` against the user's currently configured package indexes. 3. A compromised package release, index, mirror, DNS path, or local pip configuration supplies an attacker-controlled distribution. 4. Pip downloads and installs that mutable distribution. 5. Package installation or subsequent import executes attacker-controlled Python code with the invoking user ...[truncated 586 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init_project.sh:103

Finding

Unauthenticated Plaintext gRPC and Deployment-Control Services

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_project.sh:7

Finding

Unvalidated Project Name Allows Filesystem Traversal and Unintended File Overwrite

Content

View full analysis

${BASE_DIR}/proto/service.proto << 'EOF' ... EOF cat > ${BASE_DIR}/server/CMakeLists.txt << 'EOF' ... EOF cat > ${BASE_DIR}/server/server.cpp << 'EOF' ... EOF cat > ${BASE_DIR}/scripts/run_tests.sh << 'EOF' ... EOF chmod +x ${BASE_DIR}/scripts/run_tests.sh ``` ### Technical Analysis The first positional argument is directly incorporated into `BASE_DIR`. The script does not require it to be a simple project basename, reject `..` components, canonicalize the resulting path, or verify that the result remains under the current working directory. Most path expansions are also unquoted. Shell word splitting and pathname expansion can therefore alter the set of filesystem arguments when a project name contains whitespace or glob characters. A traversal value such as `../../some-directory` causes generated files to be written outside the intended working directory. Existing files with expected names such as `proto/service.proto`, `server/server.cpp`, or `scripts/run_tests.sh` can be overwritten without confirmation. ### Attack Path 1. An attacker influences the argument passed to `scripts/init_project.sh`, for example through copied setup instructions ...[truncated 1076 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Construct and canonicalize the destination beneath an explicitly approved root. 3. Verify containment after canonicalization before creating any file. 4. Quote every variable used as a path: ```bash BASE_DIR="$(pwd)/$PROJECT_NAME" mkdir -p "$BASE_DIR/proto" "$BASE_DIR/server/build" "$BASE_DIR/client" cat > "$BASE_DIR/proto/service.proto" <<'EOF' ... EOF chmod +x "$BASE_DIR/scripts/run_tests.sh" ``` 5. Refuse to overwrite an existing project unless the user provides a separate explicit overwrite flag. 6. Create the project with restrictive permissions and use atomic file creation where practical. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_report.py:115

Finding

Excel Formula Injection Through Untrusted Test Results

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a complete embedded-device gRPC test automation workflow. The supplied code chunk only initializes a project skeleton with boilerplate templates and a simple sample gRPC server. While this is tangentially related to gRPC testing, it falls materially short of the advertised functionality. Key declared capabilities—SDK analysis, SDK wrapping, build automation, descriptor generation, serial simulation, board deployment/mounting, board execution, and Excel reporting—are absent. The code’s actual primary purpose is project scaffolding, not end-to-end automated embedded gRPC test generation and execution.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/jmeter-config.md (reported line 48)May include surrounding context.

md

testclass="vn.zalopay.benchmark.GRPCSampler" 
    testname="Test Name" enabled="true">
  
  <!-- Proto descriptor path (absolute path) -->
  <stringProp name="GRPCSampler.proto">/path/to/service.protobin</stringProp>
  
  <!-- Proto folder (for imports) -->

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · references/serial-protocol.md (reported line 198)May include surrounding context.

md

server_path = os.path.join(self.mount_path, 'grpc_server')
        lib_path = os.path.join(self.mount_path, 'lib')
        
        env = os.environ.copy()
        env['LD_LIBRARY_PATH'] = lib_path + ':' + env.get('LD_LIBRARY_PATH', '')
        
        self.server_process = subprocess.Popen(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes capabilities that require reading files, generating code, and invoking build/deploy scripts, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, missing scope metadata weakens policy enforcement and can allow broader-than-expected filesystem or shell actions during activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include generic terms like 'grpc test', 'SDK测试', and 'generate jmx', which are broad enough to match ordinary user requests and invoke the skill unintentionally. Because this skill can lead to code generation, shell usage, and deployment-oriented workflows, accidental activation increases the chance of unintended file changes or operational actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes mounting SDK resources to a board, setting environment variables, starting services, and executing automated tests, but it provides no explicit warning that these actions modify target systems and generate artifacts. In embedded or lab environments, such silent operational steps can disrupt devices, expose services, overwrite files, or consume limited board resources if triggered without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example server binds to 0.0.0.0 and uses InsecureServerCredentials(), exposing the gRPC service on all network interfaces without authentication or transport encryption. In an embedded-device test environment this can allow unintended network access, interception, or unauthorized invocation of SDK-backed hardware operations, especially if the example is copied directly into production-like setups.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/cpp-server.md (reported line 300)May include surrounding context.

Start server

./venc_server 8080

Test with grpcurl (if available)

grpcurl -plaintext -d '{"device_id":"BOARD-001"}'
localhost:8080 venc.VencService/GetDeviceInfo

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The protocol exposes a remote SHUTDOWN command over an unauthenticated TCP control channel, and that capability is not required for core gRPC test execution. Any client that can reach the socket could power off or halt the board, causing denial of service, interrupting tests, and potentially disrupting shared lab infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file describes a SHUTDOWN command that powers down the board, which can affect system availability and potentially interrupt active work. The section provides no warning about the impact, need for confirmation, or operational caution, so users are not clearly informed of the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The deployment script uploads a binary to the target board and starts a server process remotely, which modifies the remote system state. Although it prints progress messages, the markdown does not warn that running this script will deploy files and launch a service on the board.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Installing Python packages at runtime via pip adds unnecessary capability beyond Excel report generation and creates a supply-chain exposure path. In this skill context, the script may run in test or CI environments connected to embedded-device workflows, so unexpected dependency installation can alter build hosts, break reproducibility, or pull unreviewed code into privileged automation environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically executes a subprocess to install a dependency without prior consent, which violates least surprise and can cause unapproved system modification. This is risky because users invoking a report generator would not reasonably expect it to reach out for packages and execute installation logic, especially in automation pipelines where such behavior may bypass normal review controls.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script spawns a pip install subprocess automatically when openpyxl is missing, which expands a simple report-generation tool into one that performs package management and code acquisition at runtime. This is dangerous because it executes external package installation without explicit operator approval, potentially changing the environment unexpectedly and introducing supply-chain risk if package sources or indexes are compromised.

Content

Scanner excerpt · scripts/generate_report.py (reported line 19)May include surrounding context.

python

except ImportError:
    print("Installing openpyxl...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "openpyxl", "-q"])
    import openpyxl
    from openpyxl.styles import Font, Alignment, PatternFill, Border, Side
    from openpyxl.utils import get_column_letter

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs a host-environment modification by running pip3 install for multiple packages automatically and silently, with errors suppressed and no user confirmation. In a build/init script for a testing skill, this can unexpectedly alter the operator's Python environment, pull unpinned dependencies from package indexes, and weaken change control or reproducibility.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The protocol documentation defines the UPLOAD payload field as containing a base64-encoded binary, but the deployment script reads the binary and transmits content.hex(). This is an active contradiction between the documented protocol and the implemented client behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file mixes English identification with Chinese descriptions and emits Chinese worksheet titles and user-facing messages throughout the script, without any option to select locale or language. This can violate language/locale policy where user-facing output should not force a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file includes user-facing comments and labels in both English and Chinese, such as the title and descriptive comments at L2-L3. Because the skill does not state a locale requirement or provide any opt-in or language-selection behavior, this may violate a policy requiring language choice or documented locale constraints.

Content

No source excerpt is available for this finding.