Security audit

data-analysis-init

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly coherent for PMO data-analysis setup, but it handles business data and external search with under-disclosed privacy and data-retention risks.

Review this skill before installing if your PMO datasets include confidential metrics, customer data, employee data, or financial information. Use sanitized sample files where possible, avoid including sensitive names or KPIs in external searches, and check generated ./user-data files because they may contain raw sample rows from the source data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个面向 PMO 的较高层数据分析初始化/报告生成能力，且包含飞书表格与网络搜索等数据来源或增强能力。但代码仅实现了离线本地文件解析：使用 pandas 读取 CSV/Excel，基于样本行推断字段类型、维度/度量类别，并输出 schema 结构。没有任何飞书 API、网络请求、搜索、报告生成、流程编排或 PMO 特定逻辑。因此代码的主要目的与描述存在明显且实质性的偏差。

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to create multiple files under ./user-data and to run a local script, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization ambiguity: an agent runtime may permit broader file-write behavior than the skill actually needs, increasing the chance of unintended overwrites or misuse when handling user-provided paths and generated artifacts.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill directs the agent to ingest local business datasets and generate configuration and report files, but it provides no privacy, retention, or sensitive-data handling guidance. In a PMO/business context, those files may contain confidential operational metrics or personal data, so silent processing and persistence can lead to accidental exposure, oversharing, or retention of sensitive information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs external search enrichment driven by internal business context, but it does not warn that prompts, search queries, or derived context may transmit sensitive commercial information to third-party services. In this PMO setting, even partial disclosure of anomalies, competitor focus, platform incidents, or KPI changes can leak strategy or nonpublic business intelligence.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This markdown template is entirely written in Chinese, including headings, placeholders, and the reporter label, which implicitly requires generated output in a specific language. The file does not offer a language option or explain that the template is intended only for a Chinese-language or region-specific workflow, so it may violate a language/locale choice policy.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: This JSON example uses Chinese column names and descriptions throughout, with no accompanying indication that the schema is region-specific or that other languages are supported. Because SQP-3 applies to all file types, this constitutes a natural-language locale policy concern when the file implicitly fixes one language without opt-in or justification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The schema output contains `sample_values` and `sample_data`, which may include confidential records from CSV or Excel inputs, and the script emits them to console or disk without warning. In a PMO/data-analysis context, uploaded files may contain business-sensitive, personal, or financial information, making inadvertent disclosure a realistic risk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script includes `sample_data` with full values from the first rows and serializes them into the generated schema output. That exceeds a minimal schema-only function and can disclose sensitive source data to stdout or downstream files, especially when users expect only metadata extraction.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The description and the rest of the skill content are presented entirely in Chinese, effectively imposing a specific language without any user opt-in or documented regional justification. Under the policy, forced language/locale behavior should be flagged unless choice or justification is provided.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The natural-language strings and usage documentation are entirely in Chinese, with no indication that this locale is optional or required for a region-specific context. Under the policy, forcing a specific language without user opt-in is a locale-policy issue.

Description-Behavior Mismatch

Low

Confidence: 79% confidence
Finding: The top-level documentation describes reading files and generating a JSON schema config, but does not mention that the tool can write results to an arbitrary output path. While saving generated schema may be convenient, it is still a write capability beyond the explicitly described read/analyze/generate behavior.

Static analysis

No suspicious patterns detected.