Security audit

smartbi-cli

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent Smartbi automation, but it needs Review because it combines broad BI/admin power with mutable global installation, plaintext token defaults, remote documentation trust, and persistent scheduled actions.

Install only in a trusted environment with a least-privilege Smartbi token. Prefer keyring or environment-variable token storage, avoid plaintext HTTP except local development, review every generated command/body before writes, schedules, permissions changes, or outbound messages, and avoid relying on unpinned `@latest` global installs for production use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Error

Location: SKILL.md:29
Finding: Mutable Global Installation of an Unpinned CLI Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-30` **Vulnerability Type**: Supply-chain exposure through an unpinned, globally installed dependency **Risk Level**: High ### Complete Code Snippet ```bash npm install -g @smartbi/cli@latest smartbi --version smartbi profile list --help ``` The same installation pattern is repeated in `references/init.md:9-10, 27, 37-38` and `README.md:71, 79-80`. ### Technical Analysis The Skill mandates installing `@smartbi/cli@latest` globally. The `latest` tag is mutable, so the code installed during a future Skill invocation may differ from the version that was reviewed. The subsequent version check only verifies that the installed release is at least version 2.0.0; it does not verify an exact version, package integrity, provenance, or expected cryptographic digest. A global npm installation may run package lifecycle scripts and places the resulting executable in a shared user or system execution path. Consequently, a compromised publisher account, registry response, package release, or dependency can execute code with the permissions of the user running the Agent. This installation method is broader than the minimum privilege necessary. A locally pinned, integrity-verified dependency would provide the required CLI functionality without modifying the global tool environment. ### Attack Path 1. An attacker compromises the npm package publisher, registry distribution path, or a transitive dependency. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. The Skill encounters a missing or outdated CLI and runs `npm install -g @smartbi/cli@latest`. 4. npm downloads and installs the attacker-controlled release, potentially executing lifecycle scripts. 5. The malicious package accesses local files, Smartbi configuration, tokens, environment variables, or Agent-accessible resources. 6. Future `smartbi` invocations continue to execute the globally installed compromised binary. ...[truncated 624 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin an exact audited version, for example `@smartbi/cli@2.x.y`, rather than using `latest`. 2. Verify the expected package integrity hash and package provenance before installation. 3. Use a lockfile and a trusted, explicitly configured npm registry. 4. Prefer a project-local or isolated installation over a global installation. 5. Disable lifecycle scripts where compatible, or review all lifecycle scripts before permitting execution. 6. Require explicit user approval before installing or upgrading executable dependencies. 7. Revalidate the package whenever the pinned version changes. 8. Verify both the exact version and the executable origin after installation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/init.md:54
Finding: Smartbi Tokens Are Passed in Process Arguments and Stored in Plaintext by Default<![CDATA[ ## Vulnerability Details **File Location**: `references/init.md:54-55` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Complete Code Snippet ```bash smartbi init \ --server-type <sdk-server-or-smartbi> \ --base-url <address> \ --token <token> \ --profile <profile-name> ``` The resulting configuration format is documented at `references/init.md:119-129`: ```yaml profile: dev profiles: dev: serverType: sdk-server baseUrl: "http://127.0.0.1:8086" token: "your-api-token" allowPlainToken: true timeoutMs: 300000 registry: source: remote checkIntervalSeconds: 300 ``` Equivalent direct-token commands also appear in `SKILL.md:31, 49, 220`, `references/init.md:63`, `references/profiles.md:50-51`, and `README.md:81`. ### Technical Analysis The default initialization path passes a Smartbi personal token as a command-line argument and stores it as a literal value in `~/.smartbi/config.yaml`. Command-line secrets may be exposed through: - Process-listing facilities while the command is running. - Shell history, depending on how the Agent invokes the command. - Terminal recording and command telemetry. - Agent execution logs and audit records. - Error reports that capture the complete command. - Other local processes that can inspect process arguments. After initialization, the token remains as plaintext in a user-accessible configuration file. The documented `allowPlainToken: true` setting explicitly enables this storage mode. Although environment-variable and keyring alternatives are mentioned, they are not the default. The Skill also requires reporting the final command after calls. While the audit did not find an explicit requirement to print the initialization command, a general command-reporting or logging layer could inadvertently expose the token unless redaction is mandatory. ### Attack Path 1. The Agent asks the user for a Smartbi personal token. 2. The user supplies the token in ...[truncated 1159 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make operating-system keyring storage the default. 2. Accept tokens through stdin or a dedicated secret-input API, never through command arguments. 3. If keyring storage is unavailable, prefer a protected environment-variable reference rather than a literal token. 4. Do not embed tokens in generated commands, output summaries, exception messages, or telemetry. 5. Apply mandatory token redaction to all Agent tool logs. 6. Enforce restrictive file permissions on Smartbi configuration files, such as owner read/write only. 7. Remove or deprecate `allowPlainToken: true` as the default. 8. If plaintext storage must remain available for compatibility, require explicit informed user consent. 9. Recommend rotating any token previously supplied through a potentially logged command line. 10. Ensure temporary request files containing webhook secrets or other credentials are created with restrictive permissions and securely deleted after use. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/rhino-template.md:45
Finding: Bearer-Authenticated Smartbi Requests May Be Sent over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `references/rhino-template.md:45-53` **Vulnerability Type**: Sensitive information transmitted without enforced transport encryption **Risk Level**: High ### Complete Code Snippet ```javascript function httpPostJson(url, token, body) { var c = new java.net.URL(url).openConnection(); c.setRequestMethod("POST"); c.setDoOutput(true); c.setDoInput(true); c.setRequestProperty("Content-Type", "application/json; charset=utf-8"); c.setRequestProperty("Authorization", "Bearer " + token); c.setConnectTimeout(30000); c.setReadTimeout(120000); ``` The accepted configuration explicitly permits plaintext HTTP at `references/init.md:119-124`: ```yaml profiles: dev: serverType: sdk-server baseUrl: "http://127.0.0.1:8086" token: "your-api-token" allowPlainToken: true ``` Plaintext HTTP examples also appear in `references/init.md:69, 86, 91` and `references/strategy.md:43-47`. ### Technical Analysis The generated Rhino script attaches a bearer token to every request made by `httpPostJson`, but the Skill does not enforce HTTPS for `BASE_URL`. The documented examples normalize `http://` endpoints, and initialization instructions state that a user-provided address is accepted without URL-format validation. Bearer tokens provide possession-based authorization. If transmitted over plaintext HTTP, any party able to observe or modify the traffic can capture and replay the token. BI query payloads and responses may also contain sensitive business information. The risk is lower for a genuinely loopback-only address, but the instructions do not limit HTTP to loopback. A user can provide a remote HTTP host, or a maliciously influenced workflow can select an attacker-controlled endpoint. The template also does not document redirect restrictions that would prevent forwarding authorization material to a different destination. ### Attack Path 1. A user or manipulated workflow confi ...[truncated 1105 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS for every non-loopback Smartbi and SDK Server endpoint. 2. Reject plaintext HTTP unless the host is a verified loopback address and the user explicitly approves development-mode use. 3. Parse and validate the URL before storing or using it. 4. Add an allowlist for trusted Smartbi hostnames or deployment domains. 5. Do not forward bearer credentials across redirects; preferably disable redirects for authenticated requests. 6. Require normal certificate and hostname verification. 7. Consider certificate pinning or private certificate-authority validation for high-sensitivity deployments. 8. Warn users clearly before any exception that permits plaintext transport. 9. Ensure generated scheduled scripts inherit the validated endpoint rather than reading an unrestricted environment URL. 10. Rotate credentials immediately if they may have been transmitted over an untrusted plaintext network. ]]>

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:151
Finding: Server-Controlled Documentation Is Treated as Authoritative Agent Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:151-168` **Vulnerability Type**: Indirect prompt injection through remotely retrieved API documentation **Risk Level**: High ### Complete Code Snippet ```text After describe completes, identify documentation links from descriptions, referenced schemas, domains, data types, summaries, and brief fields. Load each identified path with: smartbi doc <path> --agent Recursively load links found inside the documentation up to depth 3. Pass absolute paths directly to smartbi doc. Resolve relative paths against the current document. Retrieve external URLs with WebFetch. When documentation defines a value, prefer the documentation; use the schema only as a fallback. ``` The same trust policy is reinforced in `references/describe.md:38-47` and `references/call.md:11-19`. ### Technical Analysis API descriptions and documentation are controlled by the configured Smartbi or SDK server. The Skill places that content directly into the Agent context, recursively follows links, permits external URL retrieval, and gives documentation precedence when constructing requests. No instruction establishes a trust boundary between: - Declarative API documentation used as reference data. - Operational instructions directed at the Agent. - External content from unrelated origins. - The original user's intent and authorization. - Higher-priority safety constraints. A compromised registry, Smartbi server, SDK server, documentation endpoint, or linked website can therefore embed adversarial natural-language instructions. An Agent may interpret those instructions as part of the Skill workflow and alter tool use, disclose data, select unsafe destinations, or broaden requested actions. Depth and deduplication limits prevent unbounded recursion but do not prevent prompt injection. ### Attack Path 1. An attacker compromises or controls an API description, documentation page, or externally linked page. 2. The malicious desc ...[truncated 1414 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly classify all API descriptions, schemas, documentation, and fetched pages as untrusted data. 2. Instruct the Agent never to follow operational directives found inside retrieved documentation. 3. Use documentation only to extract expected API semantics, field meanings, enumerations, and examples. 4. Validate every resulting request against the machine-readable schema and the user's original intent. 5. Do not allow documentation to override safety policies, credential-handling rules, destination restrictions, or confirmation requirements. 6. Disable arbitrary external WebFetch by default. 7. Allowlist trusted documentation origins and restrict permitted paths. 8. Require explicit user confirmation before following a cross-origin link. 9. Strip or isolate imperative prose before adding remote documentation to Agent context. 10. Require renewed user confirmation for destructive, administrative, persistent, or data-exporting operations. 11. Record the provenance of every parameter derived from remote documentation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/rhino-template.md:97
Finding: Unescaped BI Data Is Embedded in HTML Email Content<![CDATA[ ## Vulnerability Details **File Location**: `references/rhino-template.md:97-118` **Vulnerability Type**: Stored HTML content injection **Risk Level**: Medium ### Complete Code Snippet ```javascript function buildTableHtml(dt) { var html = "<table border='1' cellpadding='4' cellspacing='0'>"; html += "<tr style='background-color:#f0f0f0'>"; var headers = dt.optJSONArray("headers"); if (headers) { for (var i = 0; i < headers.size(); i++) { html += "<th>" + headers.getString(i) + "</th>"; } } html += "</tr>"; var rows = dt.optJSONArray("data"); if (rows) { for (var r = 0; r < rows.size(); r++) { html += "<tr>"; var row = rows.getJSONArray(r); for (var c = 0; c < row.size(); c++) { html += "<td>" + row.getString(c) + "</td>"; } html += "</tr>"; } } html += "</table>"; return html; } ``` The resulting value is later used as HTML email content in `references/rhino-template.md:198-223`, with HTML rendering enabled. ### Technical Analysis Column headers and BI cell values are concatenated directly into HTML elements without context-appropriate escaping or sanitization. If an attacker can influence a dataset value or label, the value can terminate the intended table cell and inject arbitrary HTML. Many email clients block active JavaScript, so conventional script execution is not guaranteed. However, malicious HTML can still: - Insert deceptive links and forms. - Alter the visible report. - Add externally hosted tracking images. - Conceal legitimate data. - Create phishing content that appears to originate from a trusted scheduled report. - Exploit client-specific HTML-rendering weaknesses. Because the value may originate in stored business data and be distributed by a scheduled task, this is a stored injection issue with repeated delivery potential. ### Attack Path 1. An attacker gains th ...[truncated 1108 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. HTML-escape every dynamic header and cell value before concatenation. 2. Escape at least ampersands, angle brackets, quotation marks, and apostrophes using a well-tested encoder. 3. Apply sanitization if any limited markup must be supported. 4. Prefer plain-text email when HTML formatting is not required. 5. Disallow remote images, forms, iframes, style injection, and active-content elements. 6. Add tests containing malicious values in both headers and cells. 7. Apply the same output-encoding rules to task names, titles, summaries, URLs, and exported resource names. 8. Consider constructing the table through a trusted HTML builder rather than string concatenation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Credential Access

High

Category: Privilege Escalation
Content: timeoutMs: 300000 # 可选替代（三选一，勿与 token 并存）： # tokenEnv: SMARTBI_TOKEN_DEV # tokenKeyring: true registry: source: remote checkIntervalSeconds: 300
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The installation instructions tell users to initialize the CLI with a token that is written into ~/.smartbi/config.yaml, but provide no warning about secret handling, file permissions, rotation, or shared-machine risk. For an agent-integrated CLI capable of broad OpenAPI access, persisting access tokens insecurely increases the chance of credential leakage and unauthorized API use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly states that an agent can progress from natural-language intent to API discovery and execution, and can create and enable scheduled tasks automatically. In a skill that exposes broad Smartbi administrative and operational APIs, this normalization of autonomous execution without an explicit confirmation/safety boundary creates a real risk of unintended state-changing actions, persistent jobs, or message delivery being triggered from ambiguous prompts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill exposes capabilities that can alter systems and data sources, create schedules and ETL jobs, send messages externally, and manage users or roles, yet the description does not prominently warn that these are sensitive operations. In this context, missing warnings materially increases the risk of users and downstream agents invoking dangerous actions without understanding side effects or required authorization.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger conditions are extremely broad for a skill that can query data, manage credentials, modify models, schedule jobs, send outbound messages, and change permissions. Broad matching increases the chance the agent will invoke this high-privilege skill for ambiguous user requests, causing unintended discovery of sensitive operations or accidental execution of impactful actions.

Whitespace Padding

Medium

Category: Prompt Injection
Content: **用途**：按关键词检索 operation，适合从自然语言或片段定位 `operationKey`。 | 选项 | 说明 | | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: **用途**：按关键词检索 operation，适合从自然语言或片段定位 `operationKey`。 | 选项 | 说明 | | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | 选项 | 说明 | | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | 选项 | 说明 | | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | 选项 | 说明 | | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `--domain` / `--service` | 与 list 相同，缩小范围 | | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list | **输出契约（机器校验）**：`smartbi-cli/schemas/smartbi.cli.search.v1.schema.json`。
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `--in <fields>` | 可重复；检索字段：`operationKey`、`operationId`、`summary`、`path`、`tags`、`description`、`requestBodySchema`、`responseSchema`（逗号分隔或多次 `--in`） | | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list | **输出契约（机器校验）**：`smartbi-cli/schemas/smartbi.cli.search.v1.schema.json`。
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `--fuzzy` | 模糊匹配 | | `--case-sensitive` | 大小写敏感 | | `--limit <n>` | 最大条数（默认 20） | | `--verbose` / `--with-version` / `--with-root-version` / `--refresh` / `--json` / `--yaml` / `--agent` / `--config` | 同 list | **输出契约（机器校验）**：`smartbi-cli/schemas/smartbi.cli.search.v1.schema.json`。
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: Lines L104-L105 prescribe exact user-facing phrasing in Chinese ("话术") and instruct the agent to use it when reporting no matches. Because the file does not provide an opt-in, alternative locale, or justification that the skill is China/Chinese-specific, this is a natural-language locale policy concern.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs collecting a personal token and allows storing it as a plaintext literal in the CLI config by default. Even though safer alternatives are mentioned, defaulting to plaintext without a clear warning about local disclosure risk increases the chance of credential exposure through file reads, backups, shell history, or host compromise.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file prescribes an exact Chinese prompt for asking the user to provide a token, which enforces a specific language in user-facing interaction. Under the policy, forcing a language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified or optional.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document gives conflicting guidance for new profile creation: earlier it says new environments must not change the default automatically, but the table later says `smartbi profile add` should directly use `--set-default`. In a multi-environment BI/admin CLI, this can silently redirect subsequent operations to the wrong tenant or environment, causing accidental changes, data access, or scheduled job execution against production.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The template includes ready-to-enable examples for emailing query results and pushing them to external webhook endpoints, but it does not require an explicit confirmation, recipient validation, or a data-sensitivity warning before transmitting potentially sensitive BI data. In this skill context, the queried data may include internal business, operational, or user-scoped information, so providing outbound delivery primitives without strong guardrails increases the risk of accidental data exfiltration or unauthorized sharing.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file title and all operational guidance are written only in Chinese, which effectively imposes a specific language on users and downstream operators. Under the stated policy, a language-specific constraint should either provide user choice or clearly document why the locale restriction is required.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The scenario instructs the agent to construct message payloads and send them to external channels such as WeChat Work, DingTalk, and email, but it does not require an explicit confirmation step or a warning that business data may leave the current system boundary. In this skill context, the content may include reports, alerts, or operational data, so an agent could exfiltrate sensitive information to unintended recipients or attacker-supplied webhooks with only a natural-language prompt.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The skill title and all user-facing invocation and interaction guidance are written exclusively in Chinese, and the interaction instructions do not offer any language choice or opt-in. This can violate language/locale policy when the broader environment is not explicitly Chinese-only or region-restricted.

Static analysis

No suspicious patterns detected.