Security audit

Csv To Task

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward CSV-to-task formatting helper, with some packaging and documentation inconsistencies but no evidence of hidden or unsafe behavior.

Reasonable to install for formatting CSV rows into tasks. Review the CSV content before using it because the skill is meant to process user-provided tabular data, and treat the included tests and contributor docs as rough packaging scaffolding rather than polished project metadata.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose says this skill should be used when a user provides CSV or tabular data and wants it transformed into tasks/tickets/todos. However, the code does not parse CSV, transform rows, create task objects, or operate on user-provided tables at all. Its primary function is to run automated tests against a skill repository's documentation and file structure. This is not a supporting implementation detail of CSV-to-task conversion; it is a materially different purpose with unrelated behavior and triggers.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation text 'CSV data + task/todo/ticket creation intent' is a loose condition rather than a specific invocation rule. It does not define clear boundaries or exclusions, so many ordinary requests about tasks or tickets involving CSV data could unintentionally match.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: L14 将触发条件写成“CSV 数据 + 任务/待办/工单创建意图”，其中“任务/待办/工单创建意图”范围很宽，缺少明确触发短语、边界或排除条件。结合 L39 的“粘贴 CSV 并要求‘转换为任务’”说明，文档仍未限定哪些具体说法会触发、哪些类似请求不会触发，存在误调用风险。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The module docstring says this is an auto-generated test suite for skill 'user-provides-csv', while the manifest context names the skill 'csv-to-task'. The runtime banner also prints 'skill-factory' rather than the actual skill name, indicating the file documentation does not match what the code is ostensibly for.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The test requires the presence of `README_zh.md`, which imposes a Chinese-language documentation requirement on the skill. This is a natural-language locale constraint with no indication of user choice, opt-in, or region-specific justification in the file.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This line states 'Keep SKILL.md body in English,' which imposes a specific language requirement. Under the policy, forcing a language without opt-in is a natural-language policy violation unless clearly justified, and no justification is provided here.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The file mandates 'SKILL.md body must be in English; reference docs in English,' which is an explicit language restriction. The policy permits locale constraints only when they are justified or optional, neither of which is present here.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: 该文件整体以中文编写，且未在正文说明技能输出语言是否可由用户选择。若技能按此说明默认强制中文交互或输出，而不给用户语言/地区选择，可能违反“需提供语言选择或明确说明”的要求。

Static analysis

No suspicious patterns detected.