Security audit

Csv To Chart

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward CSV-to-chart instruction package with expected read-only handling of user-provided data and no hidden execution, persistence, or exfiltration behavior found.

Install this if you want an agent to turn CSV data into chart code. Only provide CSV files you intend the agent to read, and review generated chart code before running it, especially if it uses external plotting libraries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose is a CSV-to-chart visualization skill triggered by user-provided tabular data and requests to plot or graph it. The actual code chunk contains only a test harness for skill packaging/compliance. Its primary behavior is static validation of markdown/frontmatter, repository files, and secret patterns. No code reads CSV input, transforms data, selects chart types, or renders visualizations. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction 'Keep SKILL.md body in English' imposes a specific language requirement in natural-language project policy. Under the stated policy rules, forcing a language without offering choice or documenting a justified locale-specific constraint is a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The line explicitly states that the SKILL.md body and reference docs 'must be in English,' which is a natural-language policy constraint. Because no opt-in or documented justification is provided, this conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation description 'CSV data + chart/graph/visualization intent' is natural-language broad rather than a clearly bounded invocation rule. It does not specify exact trigger phrases, exclusions, or contexts, so ordinary requests about CSV visualization could unintentionally match.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger condition is broad enough that normal user requests about CSV data and visualization could activate the skill in situations where the user did not explicitly intend to invoke it. In an agentic environment, over-broad routing can cause unintended data handling, confusing outputs, or the wrong tool being selected, which is a real security and safety concern even though the README itself contains no direct exploit code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill explicitly allows receiving a file attachment or file path and instructs reading CSV input, but it does not declare any tool scope such as permissions or allowed-tools. That creates an undeclared file-read capability, which can lead to overbroad filesystem access and makes it harder to enforce least privilege or audit what the skill is permitted to read.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file defines a complete test runner in one _main() function, then later redefines _main() to call _run_unit_tests(), which is not defined anywhere in the file. When executed as a script, the second definition wins, causing the advertised test suite to fail at runtime and preventing the intended validations from running. In a skill-submission pipeline, this can disable or disrupt quality and security checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The test explicitly requires a file named README_zh.md to exist, which imposes a specific language/locale requirement in project documentation. This is a natural-language policy concern because the file contains no indication that Chinese is optional or justified by a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 该 README 的主要说明内容均以中文呈现，文件内未声明用户可自由选择交互语言，也未说明这是仅面向中文用户的区域化版本。根据规则，若技能在自然语言层面强制或默认单一语言而缺少用户选择，可能构成语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.