Security audit
Security checks for vulnerabilities and agentic risk
This SmartBI skill appears purpose-aligned, but it needs review because it can install a global CLI, persist access tokens, and perform broad SmartBI administrative actions.
Install only if you intend to let an agent operate a SmartBI environment with your account permissions. Prefer environment-variable or system-keyring token storage over the default plaintext config, review global npm installation, and require explicit confirmation for writes such as schedules, pushes, agent workflow changes, provider changes, permissions, or resource mutations.
The skill text presents itself as a general BI operations wrapper but also references agent workflow creation/modification, custom tool/provider handling, and script-based internal modification paths. When administrative capabilities are hidden inside a broadly described skill, users may unknowingly authorize actions that change agents, tools, or system configuration rather than merely query data.
The skill text presents itself as a general BI operations wrapper but also references agent workflow creation/modification, custom tool/provider handling, and script-based internal modification paths. When administrative capabilities are hidden inside a broadly described skill, users may unknowingly authorize actions that change agents, tools, or system configuration rather than merely query data.
The skill text presents itself as a general BI operations wrapper but also references agent workflow creation/modification, custom tool/provider handling, and script-based internal modification paths. When administrative capabilities are hidden inside a broadly described skill, users may unknowingly authorize actions that change agents, tools, or system configuration rather than merely query data.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
timeoutMs: 300000
# 可选替代（三选一，勿与 token 并存）：
# tokenEnv: SMARTBI_TOKEN_DEV
# tokenKeyring: true
registry:
source: remote
checkIntervalSeconds: 300
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
destination = Path(output_path)
if destination.exists() and not overwrite:
raise ArtifactError(f"refusing to overwrite existing file: {destination}")
destination.parent.mkdir(parents=True, exist_ok=True)
# The CLI accepts @file request bodies. A temporary file avoids shell
The skill declares no explicit tool scope while instructing use of shell, file read/write, network access, environment variables, and credential handling. In an agent environment, missing permission boundaries can allow the skill to invoke far more capability than a user would reasonably expect, including modifying local config files and transmitting sensitive tokens to remote endpoints.
The trigger condition is very broad for BI-related requests and can match ordinary analytical language, causing the skill to activate in situations the user did not intend. Because this skill can handle credentials, invoke shell commands, and perform administrative SmartBI operations, accidental activation raises the risk of unnecessary data exposure or unauthorized changes.
The scenario trigger table uses common verbs like send, notify, query, compare, and schedule without enough contextual constraints. In a high-capability skill, ambiguous triggers can route unrelated user requests into flows that discover APIs, access data, or perform messaging/scheduling actions against SmartBI systems.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**用途**：按关键词检索 operation，适合从自然语言或片段定位 `operationKey`。
| 选项 | 说明 |
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
**用途**：按关键词检索 operation，适合从自然语言或片段定位 `operationKey`。
| 选项 | 说明 |
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| 选项 | 说明 |
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| 选项 | 说明 |
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| 选项 | 说明 |
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `--domain` / `--service` | 与 list 相同，缩小范围 |
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
输出字段以当前安装 CLI 的 `smartbi search --help` 和实际 `--agent` 响应为准；Skill 不捆绑版本固定的 schema 文件。
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
输出字段以当前安装 CLI 的 `smartbi search --help` 和实际 `--agent` 响应为准；Skill 不捆绑版本固定的 schema 文件。
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `--fuzzy` | 模糊匹配 |
| `--case-sensitive` | 大小写敏感 |
| `--limit <n>` | 最大条数（默认 20） |
| `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
输出字段以当前安装 CLI 的 `smartbi search --help` 和实际 `--agent` 响应为准；Skill 不捆绑版本固定的 schema 文件。
The skill directs the agent to run a global npm install and initialize persistent user configuration, which changes the host environment and writes files under the user's account. Because the instructions do not require an explicit user-facing warning or confirmation before making these system changes, an agent could modify the system unexpectedly, violating least surprise and safe-consent expectations.
The reference instructs collecting and storing SmartBI personal access tokens, including a default mode that writes the token directly into configuration. Without a prominent warning about credential sensitivity, storage risks, shell history exposure, and disclosure boundaries, the skill normalizes unsafe secret handling and increases the chance of credential leakage.
The file's entire instructional content is written in Chinese and does not indicate that language selection is optional or limited to a justified region-specific context. Under the policy rule for language/locale constraints, this can be a natural-language policy violation when no user opt-in or documented rationale is provided.
This markdown file contains user-facing operational instructions only in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language option is provided. The text does not indicate that the skill is region-specific or that the user may choose another language.
The document explicitly directs users to provide a personal access token and states that the token will be stored directly in configuration by default, while only briefly mentioning safer alternatives. This creates a real secret-handling weakness because config-file storage increases the chance of token exposure through local file disclosure, backups, logs, or source-control mistakes, especially for a CLI that can access BI data and administrative functions.