Rohoon Six Sigma

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.8.2

Overview

The skill is mainly a Six Sigma reporting toolkit, but it includes overbroad maintenance instructions and an auto-open script behavior that users should review before installing.

Review the maintenance policy before letting an agent follow it, especially recursive backups and git add ., and run the batch PDF generator only in an environment where opening files automatically is acceptable. Prefer a virtual environment with pinned dependencies, and independently validate statistical/report conclusions before using them for audits or production quality decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6; installation instruction at README.md:29 and SKILL.md:493
Vulnerability Type: Unrestricted future dependency resolution
Risk Level: Medium

Vulnerable Code

requirements.txt:1-6:

text

numpy>=1.23.0
scipy>=1.10.0
reportlab>=4.0.0
openpyxl>=3.1.0
matplotlib>=3.7.0
pandas>=2.0.0

Installation instruction:

bash

pip install -r requirements.txt

Technical Analysis

Every dependency is specified using only a minimum version. There are no exact version pins, upper bounds, package hashes, or lockfile. Consequently, installing the project at a later date may resolve to dependency versions that were not present during this audit.

Python packages can execute package-controlled build or installation logic, and their runtime code is imported with the privileges of the user running the Skill. If an upstream release or its distribution account is compromised, following the documented installation command may introduce code that was never reviewed with this project. Uncontrolled upgrades can also silently change statistical calculations, spreadsheet handling, or generated reports.

No currently listed package was identified as malicious. The risk is the absence of controls preventing future, unreviewed supply-chain changes.

Attack Path

1. An upstream dependency release or package distribution account is compromised.
2. A malicious or otherwise unsafe version is published while still satisfying the minimum-version constraint.
3. A user follows the documented pip install -r requirements.txt instruction.
4. The package resolver selects the newly published, unaudited version.
5. Package-controlled code executes during installation, import, or normal report processing with the installing user's privileges.

Impact Assessment

A compromised dependency would run under the account that installs ...[truncated 296 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every runtime dependency to an explicitly reviewed version.
2. Generate and commit a reproducible lockfile appropriate for the deployment workflow.
3. Record cryptographic hashes and install with hash verification, such as pip install --require-hashes.
4. Review dependency updates before changing pins, including release history, transitive dependencies, and published artifacts.
5. Build and test dependencies in an isolated virtual environment or container without unnecessary secrets or filesystem access.
6. Add automated vulnerability and dependency-integrity scanning to the release process.
7. Keep source indexes explicitly configured to trusted repositories and disable unexpected supplemental indexes.

T01 · Skill Instruction Hijacking

Warning

• Location: SECURITY_POLICY.md:22

Finding

Bundled Instructions Direct Unnecessary Workspace and Git State Modification

Content

View full analysis

Vulnerability Details

File Location: SECURITY_POLICY.md:22-32 and SECURITY_POLICY.md:127-132
Vulnerability Type: Out-of-scope agent instructions and excessive workspace mutation
Risk Level: Medium

Vulnerable Code

SECURITY_POLICY.md:24-25 directs recursive workspace backup creation:

bash

mkdir -p backups
cp -r . backups/v$(date +%Y%m%d_%H%M%S)_pre_$(operation_name)/

SECURITY_POLICY.md:31-32 directs repository initialization and indiscriminate staging:

bash

git init
git add .

The same policy also states that workspace and repository checks should be performed at the beginning of every session.

Technical Analysis

The Skill's declared purpose is statistical analysis and report generation. Initializing a repository, staging all files, recursively duplicating workspace content, and inspecting broader workspace state are not necessary to calculate SPC, MSA, or DOE results.

If an agent treats this bundled policy as operative session-level guidance, git add . can stage unrelated untracked files, generated reports, local configuration, or sensitive material located within the working tree. Recursive backup commands can similarly duplicate content into locations with different retention or access characteristics. Repeated recursive backups may also create excessive storage consumption if backup directories are not excluded.

This is instruction-scope overreach rather than evidence of an intentional malicious payload. The audit found no code that automatically executes these commands.

Attack Path

1. The Skill is loaded and its bundled policy is interpreted as authoritative operational guidance.
2. The agent follows the backup or repository instructions without a specific user request.
3. The recursive copy duplicates all accessible content beneath the working directory, or git add . stages all visible files.
4. Unrelated files, generated data, or secrets in the wo ...[truncated 649 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove mandatory session-wide instructions from Skill documentation.
2. Treat backup and repository maintenance as optional operator guidance, not as actions the agent should perform automatically.
3. Require explicit user confirmation before creating backups, initializing Git, staging files, or inspecting paths outside the project.
4. Replace git add . with an explicit allowlist of intended project files.
5. Add comprehensive ignore rules for credentials, local configuration, generated reports, temporary files, virtual environments, and backup directories.
6. Store backups outside the source tree to prevent recursive copying and repository inclusion.
7. Apply restrictive permissions and a defined retention policy to backups.
8. Constrain all routine Skill operations to the project directory and the output paths explicitly selected by the user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (54)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

All headings, instructions, examples, and status text in the file are presented exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file presents core security policy content in Chinese, beginning with the title at L001, and continues throughout the document without indicating that another language is available or that Chinese is required for a specific regional/compliance reason. This creates a natural-language locale constraint that may exclude users or operators without opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY_POLICY.md (reported line 24)May include surrounding context.

bash

# 每次重大修改前必须创建备份
cd ~/.openclaw/workspace/skills/rohoon-6sigma
mkdir -p backups
cp -r . backups/v$(date +%Y%m%d_%H%M%S)_pre_$(操作名称)/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY_POLICY.md (reported line 24)May include surrounding context.

bash

# 每次重大修改前必须创建备份
cd ~/.openclaw/workspace/skills/rohoon-6sigma
mkdir -p backups
cp -r . backups/v$(date +%Y%m%d_%H%M%S)_pre_$(操作名称)/

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SECURITY_POLICY.md (reported line 78)May include surrounding context.

1. 立即停止所有操作
2. 检查备份目录

   bash

   ls -la ~/.openclaw/workspace/skills/rohoon-6sigma/backups/
   

3. 恢复最新备份

   bash

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SECURITY_POLICY.md (reported line 86)May include surrounding context.

1. 立即停止所有操作
2. 检查备份目录

   bash

   ls -la ~/.openclaw/workspace/skills/rohoon-6sigma/backups/
   

3. 恢复最新备份

   bash

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SECURITY_POLICY.md (reported line 92)May include surrounding context.

1. 立即停止所有操作
2. 检查备份目录

   bash

   ls -la ~/.openclaw/workspace/skills/rohoon-6sigma/backups/
   

3. 恢复最新备份

   bash

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python skill uses Chinese-only natural-language documentation in the module docstring, and the rest of the file continues the same pattern for class and function descriptions. For a general-purpose analytical skill, this imposes a specific language/locale on users without offering choice or documenting that the skill is region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring and report labels for generate_figure12_2 describe a non-normal/mixed distribution report, including output text such as non_normal and Mixed (C4). However, the function reuses calculate_stats, which derives PPM via stats.norm.cdf and uses the same normal probability plot machinery, so the implemented calculations remain normal-model-based despite the report claiming a non-normal/mixed model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring and later runtime behavior indicate the script is designed specifically for Chinese and English output, and the main routine always generates both language variants automatically. This creates a locale/language constraint with no user opt-in or configurable language selection exposed in the script's batch entrypoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs an undocumented side effect beyond report generation by causing the OS to open every generated PDF automatically. In an agent or automation context, spawning external applications can create unexpected execution paths, user disruption, and trust-boundary violations, especially when the documented purpose is only to generate reports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatically opening all generated PDFs without user consent can trigger external applications unexpectedly and is risky in unattended, CI, or agent-driven environments. Even though the filenames come from a controlled directory listing, the behavior expands the script's authority from file generation into external process execution without warning.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_generate_reports_v2.py (reported line 419)May include surrounding context.

python

for output_dir in [output_dir_en, output_dir_cn]:
    for f in sorted(os.listdir(output_dir)):
        if f.endswith('.pdf'):
            subprocess.run(['open', os.path.join(output_dir, f)], check=False)

print("完成！")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file-level claim that the tool supports Xbar-S charts is inaccurate because Xbar-S requests are processed by the Xbar-R calculation path. In a statistical quality-control tool, this can silently produce incorrect control limits and out-of-control decisions, causing users to make bad operational or manufacturing decisions based on invalid analysis.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI advertises Xbar-S as a valid chart type, but the program has no dedicated Xbar-S implementation and routes it to Xbar-R logic. This mismatch is dangerous because users can explicitly request Xbar-S and receive plausible-looking but incorrect output without any warning, undermining trust and potentially affecting process-control decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The report generator is instantiated with lang='zh', forcing a specific language/locale. The file does not offer a user opt-in or selection mechanism, and there is no documented justification that this skill is strictly region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language documentation and later user-facing strings exclusively in Chinese, which imposes a specific language on users without offering a locale choice. The policy explicitly calls out forced language/locale behavior as a violation when there is no opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The docstrings and surrounding natural-language guidance indicate the skill is written for a single language audience, and no mechanism exists for users to select another language. For organizational language policy, hardcoding one locale without opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module title and all user-visible workbook labels are written in Chinese, indicating the generated report is fixed to a single language. The file does not provide any opt-in, locale selection, or justification that this skill is intended only for a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The control-chart summary table hardcodes the status as 'In Control ✅' without validating whether any subgroup violates control limits or run rules. This creates a false assurance artifact directly inside the generated PDF, which is especially risky because reports may be used as evidence for process acceptance or compliance decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The report conclusion claims the process is in statistical control and that no out-of-control points were detected, but the code does not perform any control-rule evaluation before making that statement. In a quality or manufacturing context, this can mislead operators or auditors into trusting an unstable process, causing bad product release or missed investigation of process drift.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language descriptions and operational log output entirely in Chinese, including the module docstring and later user-visible status messages. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The logger outputs completion and evaluation messages only in Chinese, and similar single-language runtime text appears elsewhere in the file. If these logs are surfaced to users or operators, the skill enforces one locale without opt-in or configuration, which falls under the language policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.