Security audit

保险Excel自动数据分析工具

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated insurance data-analysis purpose, but it can send dataset-derived summaries to third-party AI services without a clear consent or redaction step.

Review before installing or using this with real customer, policy, claims, underwriting, financial, or regulated insurance data. Only use the AI insight step if your organization permits sending dataset-derived summaries to Kimi or DeepSeek; otherwise run the local analysis/report steps and supply a local or redacted insight text. Keep API keys scoped and avoid persistent shell-profile storage on shared machines.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill instructs the agent to read user-provided files and write analysis outputs and reports, but it declares no permissions or equivalent user-facing notice. That creates a transparency and policy gap: users and hosting platforms cannot accurately evaluate what filesystem access the skill will exercise, increasing the risk of unintended file access or overwriting outputs.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guidance instructs the agent to send analysis outputs to third-party Kimi/DeepSeek services, which expands the skill from local Excel analysis into external data transfer. Because the prompt includes dataset summaries, cleaning logs, and chart descriptions, potentially sensitive insurance-related information may be disclosed off-platform without explicit user approval or data-minimization controls.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The sample code reads API credentials from environment variables and uses them to transmit analysis summaries to external APIs. In a data-analysis skill handling insurance spreadsheets, this creates a real risk of unauthorized disclosure of confidential business or personal data, while also normalizing secret use and outbound network access not clearly required by the advertised skill scope.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad terms like '数据分析', '生成图表', and '制作报告', which are common requests and can cause the skill to auto-activate in situations the user did not intend. In this skill, unintended activation is more concerning because it can lead to file processing and downstream sharing of derived data with external LLM providers.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly states that the agent will call external models such as Kimi or DeepSeek to generate insights, but the description does not warn users that uploaded insurance data or summaries derived from it may be sent to third-party providers. Because the data may include policy, claims, or customer information, this omission creates a significant privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises automatic cleaning actions such as deleting empty rows, removing duplicates, filling missing values, and marking outliers, but it does not warn users that these operations may alter or remove records. In an insurance context, silent modification of business data can affect auditability, downstream analysis accuracy, and user trust.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guidance omits any warning that dataset-derived summaries and chart descriptions will be sent to third-party APIs. This lack of transparency is dangerous because users may believe analysis stays local while insurance-related data characteristics are actually disclosed externally.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow explicitly instructs the agent to inject `summary.json` contents and chart descriptions into external Kimi or DeepSeek APIs, but provides no privacy notice, consent gate, data minimization guidance, or redaction requirements. Because this skill is designed for insurance Excel analysis, the uploaded data may contain sensitive personal, financial, or underwriting information, so transmitting derived or raw dataset details to third-party AI services can create a serious confidentiality and compliance risk.

Static analysis

No suspicious patterns detected.