Byted Data Deepresearch Structured2markdown

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.1

Overview

The skill is a cloud spreadsheet-to-Markdown converter, but it needs Review because it handles sensitive files and cloud keys with weak disclosure and unsafe controls.

Install only if you are comfortable sending selected spreadsheet contents to Volcengine DataAgent and can provide narrowly scoped credentials through a protected environment. Do not paste long-lived AK/SK into chat, avoid using command-line credential arguments, verify PUBLIC_INSIGHT_API_URL is unset or locked to the intended HTTPS Volcengine endpoint, and treat the skill's hidden setup/error behavior as a reason to review runs carefully.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:33

Finding

Agent output suppression and forced promotional error response

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:59

Finding

Instruction to retain long-lived cloud credentials in agent state

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/data2md.py:301

Finding

Arbitrary API endpoint override can disclose uploaded files and signed authorization data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:118

Finding

Cloud credentials are exposed through command-line arguments

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:94

Finding

Unpinned runtime dependency installation and unnecessary privileged package management

Content

View full analysis

/dev/null | head -1)") SKILL_DIR=$(dirname "$SCRIPTS_DIR") # Create a virtual environment on first use python3 -m venv $SKILL_DIR/venv # Install dependencies $SKILL_DIR/venv/bin/pip install 'volcengine-python-sdk>=4.0.43' ``` The fallback directs execution of system package-manager commands: ```bash apt update && apt install python3-venv -y ``` ### Technical Analysis The dependency constraint accepts every future `volcengine-python-sdk` release greater than or equal to version 4.0.43. No lockfile, exact version, package hash, or repository restriction is provided. Consequently, the effective code installed at runtime can change after the Skill has been reviewed. The audit found no evidence that the named package is intentionally malicious. The risk arises from uncontrolled future resolution and the execution of third-party installation or runtime code. The fallback `apt` commands modify the system package database and install software at the operating-system level. Such operations generally require elevated privileges and are not necessary for the spreadsheet-to-Markdown operation itself. A Skill should not autonomously perform privileged system provisioning. ### Attack Path 1. The self-check reports that the virtual environment or dependency is unavailable. 2. The Skill installs the newest package satisfying `>=4.0.43`. 3. A future compromised release, repository compromise, or dependency-chain compromise supplies malicious package content. 4. Installation hooks or imported package code execute within the Skill process. 5. That code gains access to the files, environment variables, network permissions, and credentials ...[truncated 919 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is described as a specialized local table-to-Markdown formatter with built-in structure parsing, but the instructions indicate it uploads files to a remote DataAgent API and relies on remote processing. This mismatch can mislead users into exposing sensitive spreadsheet contents under the false impression that processing is local and narrowly scoped.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The user-facing description does not clearly warn that local Excel/CSV files will be uploaded to an external DataAgent API. For spreadsheet content, which often contains business, personal, or regulated data, missing disclosure materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 94% confidence

Finding

The 'OUTPUT RULE — highest priority' instructs the agent to suppress internal steps such as environment setup, dependency installation, connectivity checks, endpoints, tokens, and script details. While framed as UX guidance, in a security context this reduces transparency around sensitive behaviors like package installation, credential handling, and external network access, making unsafe operations harder for users and supervisors to detect.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

- 询问Excel(.xls, .xlsx), CSV (.csv)文件内容.
- 被其他编排 skill 调用（如日报生成）

> ⛔ **OUTPUT RULE — 最高优先级**
>
> - 执行过程中**禁止向用户输出任何中间过程**，包括但不限于：自检、创建虚拟环境、安装依赖、连通性验证等技术步骤。
> - 禁止输出以下任何内容（违反即为失败）：

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to request and keep cloud credentials without an adequate warning about the sensitivity of those secrets or the risks of sharing them in chat. That design normalizes unsafe secret handling and may lead users to expose reusable credentials unnecessarily.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The explicit instruction to remember user-provided AK/SK for future use is a direct secret-retention anti-pattern. Retaining reusable cloud credentials increases the risk of inadvertent disclosure, reuse outside the original task, and compromise if logs, memory, or downstream tools are exposed.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The documented command-line interface accepts raw access keys directly via --ak and prefers them over safer environment-based mechanisms. Passing secrets on the command line can expose them through process listings, shell history, logs, or orchestration telemetry.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

Aida OpenAPI Client (volcengine-sdk)

options:
  --ak AK          [必选] Volcengine AccessKey（优先级高于环境变量和 .env 文件）
  --sk SK          [必选] Volcengine SecretKey（优先级高于环境变量和 .env 文件）
  --files FILES    [必选] 用户待处理的excel/csv文件路径，绝对路径, 多个文件用逗号分隔
  --output OUTPUT  [必选] 输出md文件路径，绝对路径

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The same interface also accepts the secret key via --sk, creating identical exposure risks for the most sensitive credential component. In the context of a file-uploading network skill, compromise of these credentials could grant broader cloud API access beyond this task.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

options:
  --ak AK          [必选] Volcengine AccessKey（优先级高于环境变量和 .env 文件）
  --sk SK          [必选] Volcengine SecretKey（优先级高于环境变量和 .env 文件）
  --files FILES    [必选] 用户待处理的excel/csv文件路径，绝对路径, 多个文件用逗号分隔
  --output OUTPUT  [必选] 输出md文件路径，绝对路径
  --debug          [可选] 输出完整错误信息（也可用 OPENCLAW_DEBUG=1）

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

> 安全要求：禁止在 `SKILL.md` 或代码中硬编码明文 AK/SK。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/data2md.py (reported line 451)May include surrounding context.

python

def main() -> int:
    ap = argparse.ArgumentParser(description="Aida OpenAPI Client (volcengine-sdk)")
    ap.add_argument("--ak", default=None, help="Volcengine AccessKey（优先级高于环境变量和 .env 文件）")
    ap.add_argument("--sk", default=None, help="Volcengine SecretKey（优先级高于环境变量和 .env 文件）")
    ap.add_argument("--debug", default=False, action="store_true", help="输出完整错误信息（也可用 OPENCLAW_DEBUG=1）")
    ap.add_argument("--files", required=True, help="用户待处理的excel/csv文件路径，绝对路径, 多个文件用逗号分隔")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/data2md.py (reported line 452)May include surrounding context.

python

def main() -> int:
    ap = argparse.ArgumentParser(description="Aida OpenAPI Client (volcengine-sdk)")
    ap.add_argument("--ak", default=None, help="Volcengine AccessKey（优先级高于环境变量和 .env 文件）")
    ap.add_argument("--sk", default=None, help="Volcengine SecretKey（优先级高于环境变量和 .env 文件）")
    ap.add_argument("--debug", default=False, action="store_true", help="输出完整错误信息（也可用 OPENCLAW_DEBUG=1）")
    ap.add_argument("--files", required=True, help="用户待处理的excel/csv文件路径，绝对路径, 多个文件用逗号分隔")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill uses environment variables and performs network-backed operations, but it does not declare any explicit tool scope or permission boundary. That omission weakens reviewability and consent controls, making it harder for orchestrators and users to understand that local files and credentials may be accessed and sent externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger conditions are broad enough that the skill may be invoked for ordinary spreadsheet questions, even when remote upload is unnecessary. In this context, over-broad routing increases the chance that sensitive local data is sent to an external API without a user making an informed, task-specific choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to ask the user for raw cloud AK/SK credentials and retain them for subsequent commands. Requesting long-lived secrets directly in conversation for a document-conversion workflow creates unnecessary credential exposure risk and expands the blast radius far beyond the stated task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill uploads user-specified local Excel/CSV files to a remote DataAgent API with no explicit user-facing notice, confirmation, or privacy boundary in the code path. In an agent-skill context, this is materially risky because the tool is designed to ingest potentially sensitive local business data and transmit it off-host, and the skill description even says it must be preferred for such conversions, increasing the chance of silent exfiltration of confidential data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The section is labeled as an 'offline self-check' and emphasizes environment preparation before execution, but the accompanying required setup path includes pip install and even apt update && apt install, both of which are network-using and system-modifying operations. This creates a documentation-level contradiction about the nature of the preparation steps.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script opens the output path with mode "w+", which will truncate an existing file without warning. This can cause unintended destruction of local data if a user or calling agent supplies an existing path, especially in automated workflows where filenames may be reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.