Security audit

财务报表审查

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for financial document review, but it needs review because it processes sensitive files with under-scoped file access helpers and risky document-parser dependency constraints.

Install only in a controlled environment. Avoid processing untrusted PDFs or broad directories until dependencies are pinned to reviewed safe versions, parser execution is sandboxed or resource-limited, and the data-loader path handling and sensitive-data handling guidance are tightened.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: `load_reference_file(filename)` joins an arbitrary `filename` with `REFERENCES_DIR` and opens the result without validating that the resolved path stays داخل the intended directory. An attacker who can influence `filename` could use `../` path traversal to read other local files, potentially exposing secrets, configuration, or sensitive business data.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: `load_csv_data(filename)` constructs a path from attacker-controllable input and reads it as a file without constraining traversal outside `DATA_DIR`. If exposed through higher-level skill inputs or plugins, this can be abused to read arbitrary readable files on the host, which is a classic local file disclosure issue.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README encourages parsing highly sensitive financial statements and tax data, but it does not warn users about handling confidential information, storage, retention, access control, or redaction. In a finance-focused skill, this omission can lead users to process real corporate data without adequate safeguards, increasing the chance of privacy breaches or regulatory noncompliance.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 核心依赖 pandas>=2.0.0 numpy>=1.24.0 # Excel 文件解析
Confidence: 93% confidence
Finding: Using a lower-bound specifier like pandas>=2.0.0 allows future major or minor releases to be installed without review, which can introduce supply-chain instability, unexpected vulnerable versions in some environments, or breaking behavior. In a document-processing skill that handles financial statements, dependency drift increases operational and security risk because parsing libraries are exposed to attacker-controlled files.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # 核心依赖 pandas>=2.0.0 numpy>=1.24.0 # Excel 文件解析 openpyxl>=3.0.0
Confidence: 93% confidence
Finding: The unpinned numpy dependency permits uncontrolled version selection during installation, which weakens reproducibility and can pull in versions with known defects or incompatible behavior. Although numpy itself is often lower-risk than network-facing packages, version drift still contributes to supply-chain exposure in production systems.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.24.0 # Excel 文件解析 openpyxl>=3.0.0 xlrd>=2.0.0 # Word 文件解析
Confidence: 95% confidence
Finding: openpyxl parses Excel files, so leaving it unpinned is more dangerous than a purely utility package because installer drift can silently introduce parser vulnerabilities or denial-of-service conditions. Since this skill is designed to ingest financial spreadsheets, that context makes uncontrolled upgrades materially riskier.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Excel 文件解析 openpyxl>=3.0.0 xlrd>=2.0.0 # Word 文件解析 python-docx>=0.8.11
Confidence: 90% confidence
Finding: xlrd is unpinned, creating reproducibility and supply-chain risk similar to the other dependencies. Its impact is somewhat lower here because modern use of xlrd is narrower, but if .xls files are accepted it still participates in untrusted document parsing.

Unpinned Dependencies

Low

Category: Supply Chain
Content: xlrd>=2.0.0 # Word 文件解析 python-docx>=0.8.11 # PDF 文件解析（任选其一或全部安装） pdfplumber>=0.6.0
Confidence: 95% confidence
Finding: python-docx processes Office documents, and an unpinned parser dependency can expose the application to parser bugs, XXE-related regressions, or malformed-file denial of service after an unnoticed upgrade. Because the skill may review uploaded financial supporting documents, this makes the issue more relevant than a generic package-management concern.

Unpinned Dependencies

Low

Category: Supply Chain
Content: python-docx>=0.8.11 # PDF 文件解析（任选其一或全部安装） pdfplumber>=0.6.0 PyPDF2>=3.0.0 pdfminer.six>=20221105
Confidence: 95% confidence
Finding: pdfplumber is used for PDF parsing, and untrusted PDF input is a common attack vector for denial of service and parser exploitation. Allowing arbitrary newer versions through a >= specifier reduces change control and increases the risk of deploying an unsafe or breaking parser version in a financial document workflow.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # PDF 文件解析（任选其一或全部安装） pdfplumber>=0.6.0 PyPDF2>=3.0.0 pdfminer.six>=20221105 # 中文处理
Confidence: 96% confidence
Finding: PyPDF2 is directly exposed to attacker-controlled PDFs in this skill's likely usage, so unpinned installation can lead to accidental deployment of versions with known parsing-related vulnerabilities or performance issues. The context of processing external financial statements and attachments makes this more dangerous than a generic development dependency.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pdfminer.six>=20221105 # 中文处理 jieba>=0.42.1 # 可选依赖 # xlwt>=1.3.0 # 用于写入 .xls 文件
Confidence: 84% confidence
Finding: jieba is a text-processing library, and leaving it unpinned still creates reproducibility and supply-chain risk, though its exposure is generally lower than file-format parsers. In this skill it is less dangerous than the document-ingestion libraries, but deterministic builds are still preferable.

Known Vulnerable Dependency: openpyxl — 2 advisory(ies): CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The requirement openpyxl>=3.0.0 allows installation of version 3.0.0, and the cited XXE vulnerability in openpyxl affects versions before the later fixes. Because this skill is intended to parse externally supplied Excel financial statements, XXE can enable file disclosure, SSRF-style behavior, or parser compromise paths depending on runtime configuration.

Known Vulnerable Dependency: python-docx — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: python-docx>=0.8.11 permits installation of 0.8.11, but the cited XXE issue affects versions before 0.8.6 and therefore the exact minimum shown is not vulnerable; however, this package choice itself is not affected by that advisory. Given the version in the file, this static finding is not a true vulnerability.

Known Vulnerable Dependency: PyPDF2 — 5 advisory(ies): CVE-2023-36464 (pypdf and PyPDF2 possible Infinite Loop when a comment isn't followed by a chara); CVE-2023-36807 (PyPDF2 vulnerable to possible Infinite Loop when reading malformed objects); CVE-2023-36810 (PyPDF2 quadratic runtime with malformed PDF missing xref marker) +2 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: PyPDF2>=3.0.0 appears to include versions affected by multiple 2023 malformed-PDF infinite-loop and quadratic-runtime issues. In this skill, PDFs are a primary input type, so denial-of-service via crafted documents is a realistic threat that could hang workers or exhaust compute during financial statement review.

Known Vulnerable Dependency: pdfminer.six — 2 advisory(ies): CVE-2025-70559 (Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc); CVE-2025-64512 (Arbitrary Code Execution in pdfminer.six via Crafted PDF Input)

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The requirement pdfminer.six>=20221105 allows versions that may be affected by the cited advisories if not further constrained, including severe parser issues associated with crafted PDFs. Since this skill explicitly processes potentially untrusted financial PDFs, parser vulnerabilities here are especially dangerous and can lead to denial of service or worse depending on the flaw and deployment model.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.