Security audit

GDPR Check - GDPR合规检查

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed cloud-scored GDPR checklist with proportionate network and local key storage behavior, though users should be cautious with generated HTML reports.

Install only if you are comfortable sending GDPR checklist answers to compliancehub.cn for scoring. Prefer text or JSON output for sensitive use, or treat HTML reports as untrusted files because cloud-provided report text is not HTML-escaped in this version.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gdpr-check.py:323
Finding: Unescaped Cloud-Controlled Data in Generated HTML Report
Content: View full analysis
{current_cat}\n' icon = "✅" if r.get("passed") else "❌" cls = "pass" if r.get("passed") else "fail" rec = r.get("recommendation") or "Keep it up" rows += f"""{icon}{r.get('name')}{r.get('legal_ref') or ''}{cls.upper()}{rec}\n""" ``` ### Technical Analysis The HTML report renderer directly interpolates `category_name`, `name`, `legal_ref`, and `recommendation` into HTML markup without applying HTML escaping or sanitization. These values originate from data returned by the remote cloud evaluation service. Consequently, they cross an external trust boundary and cannot safely be treated as HTML. A malicious or compromised service could return values containing elements or event handlers such as: ```html ``` The value would be written verbatim into the generated report. When a user opens that report in a browser, the injected markup can be interpreted and executed. The fixed HTTPS endpoint and certificate validation reduce exposure to network interception, but they do not protect against a compromised endpoint, malicious backend response, or server-side data poisoning. ### Attack Path 1. A user explicitly runs the GDPR check and requests HTML output, such as: `python3 scripts/gdpr-check.py --format html -o gdpr-check-report.html`. 2. The Skill submits the assessment answers to the fixed cloud evaluation endpoint. 3. A compromised or malicious cloud response places attacker-controlled HTML or JavaScript in a report field such as `recom ...[truncated 1071 chars]
Remediation: View remediation
``` 5. Add regression tests using payloads such as: ```html "> ``` Verify that generated reports contain escaped text such as `<script>` rather than executable markup. 6. Treat all cloud response fields as untrusted, even though the endpoint is pinned and accessed over TLS. Validate expected data types, impose reasonable length limits, and reject malformed response structures. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring states that item names, categories, and recommendations are presented in Chinese by default, while only allowing English if users request it later. This imposes a default locale choice rather than offering an upfront language selection or clear opt-in, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.