Security checks for vulnerabilities and agentic risk
Overview
This GDPR skill appears mostly local, but its main command can load unreviewed code from outside the skill package, so it needs Review before use.
Install only after reviewing or removing the parent-directory compliance_core dependency. Prefer an isolated virtual environment, pinned dependencies, and a known trusted compliance_core source. Treat generated reports as sensitive local files, avoid HTML/CSV output for untrusted content, and use the legal outputs only as drafts for professional review.
Unpinned and Unnecessary Dependencies Create Supply-Chain Exposure
Content
View full analysis
=2.0.0,<3.0.0 # Data analysis and processing
# Template engine
jinja2>=3.1.0,<4.0.0 # Document template generation
```
The documentation instructs users to install whichever compatible releases the package index currently returns:
```bash
pip install -r requirements.txt
```
### Technical Analysis
The installation process does not pin exact package versions, lock transitive dependencies, or verify distribution hashes. Therefore, installations performed at different times may resolve to different code.
Python packages can execute code during build or installation, and imported dependencies execute Python code at runtime. If a permitted release or one of its transitive dependencies is compromised, the installation workflow can introduce attacker-controlled code even though the Skill itself was previously reviewed.
The inspected runtime scripts do not import `pandas` or `jinja2`, so these dependencies increase the attack surface without a demonstrated runtime requirement. The broad ranges also undermine reproducibility and make the security guide’s assertion that the dependencies are safe impossible to guarantee over time.
No evidence was found that the currently named packages are malicious. The vulnerability is the unsafe and unnecessary dependency-resolution process.
### Attack Path
1. A permitted future release or transitive dependency is compromised, or an attacker gains control of a package publication channel.
2. The victim follows the documented installation instruction:
```bash
pip install -r requirements.txt
```
3. `pip` resolves the compromised release because it satisfies the broad version constraint.
4
...[truncated 788 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/utils/gdpr_report_formatter.py:447
Finding
Unescaped Report Content Enables HTML Script and Spreadsheet Formula Injection
Content
View full analysis
str:
"""Convert to HTML format"""
# Simplified implementation
import json
return f"text
{json.dumps(data, ensure_ascii=False, indent=2)}
"
```
CSV output writes report-controlled values without neutralizing spreadsheet formulas:
```python
def _convert_to_csv(self, data: Dict[str, Any]) -> str:
"""Convert to CSV format"""
# Simplified implementation
import csv
import io
output = io.StringIO()
writer = csv.writer(output)
# Only process simple data structures
if "checks" in data:
writer.writerow(["Check Item", "Status", "Description"])
for check_name, check_data in data["checks"].items():
writer.writerow([
check_data.get("description", check_name),
check_data.get("status", ""),
"; ".join(check_data.get("details", []))
])
return output.getvalue()
```
### Technical Analysis
#### HTML injection
`json.dumps()` escapes JSON syntax but does not perform HTML-context escaping. If a report field contains a value such as:
```html
text
```
the value terminates the `text
` element and introduces executable HTML. When the generated report is opened in a browser or embedded in another HTML page, the injected script can execute in that document’s origin.
#### CSV formula injection
The `csv` module correctly quotes delimiters but does not neutralize spreadsheet formulas. Cells beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas by spreadsheet applications. A malicious assessment description or detail can therefor
...[truncated 2020 chars]
Remediation
View remediation
{html.escape(serialized)}"
```
2. Prefer a templating engine with automatic HTML escaping enabled, and ensure report values are never marked safe unless they are trusted constants.
3. Add a restrictive Content Security Policy to standalone HTML reports, for example by disallowing scripts and external resource loading.
4. Neutralize spreadsheet formulas before CSV serialization. For every string cell:
- Detect optional leading whitespace followed by `=`, `+`, `-`, or `@`.
- Prefix dangerous values with a single quote or another application-compatible neutralization character.
- Document that the output is intended as text, not formulas.
5. Treat all questionnaire answers, company names, descriptions, recommendations, and imported assessment data as untrusted.
6. Add regression tests using payloads containing:
- ``
- HTML event-handler attributes.
- Formula prefixes with and without leading whitespace.
- Embedded newlines and delimiters.
7. Consider making JSON the default and only output format until active-content formats have context-appropriate encoding.
]]>
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (33)
Tp4
High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims broad compliance assessment, multi-format output, unified CLI, and cross-jurisdiction support, but the code chunk shows mostly template/document generation. While this may not be an exploit primitive by itself, it is still a trust and safety issue because users may act on incomplete artifacts as if they were validated assessments.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims broad compliance assessment, multi-format output, unified CLI, and cross-jurisdiction support, but the code chunk shows mostly template/document generation. While this may not be an exploit primitive by itself, it is still a trust and safety issue because users may act on incomplete artifacts as if they were validated assessments.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill claims broad compliance assessment, multi-format output, unified CLI, and cross-jurisdiction support, but the code chunk shows mostly template/document generation. While this may not be an exploit primitive by itself, it is still a trust and safety issue because users may act on incomplete artifacts as if they were validated assessments.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill claims broad compliance assessment, multi-format output, unified CLI, and cross-jurisdiction support, but the code chunk shows mostly template/document generation. While this may not be an exploit primitive by itself, it is still a trust and safety issue because users may act on incomplete artifacts as if they were validated assessments.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill claims broad compliance assessment, multi-format output, unified CLI, and cross-jurisdiction support, but the code chunk shows mostly template/document generation. While this may not be an exploit primitive by itself, it is still a trust and safety issue because users may act on incomplete artifacts as if they were validated assessments.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
This markdown file is written almost entirely in Chinese, including headings and operational descriptions, without offering a language choice or explaining that the skill is intended only for a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The README content is written entirely in Chinese, including usage guidance and legal disclaimers, with no indication that users may choose another language or that the locale is optional. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in or explicit justified documentation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The file begins with a Chinese title and the document body is written in Chinese throughout, but it does not offer users an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises script execution and file/report generation but does not declare any explicit tool scope such as allowed-tools or permissions. When a skill can invoke shell, read files, write files, or potentially reach network-capable paths without a tight manifest, the runtime may grant broader access than users or reviewers expect, increasing the blast radius of misuse or prompt-triggered actions.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding
The skill description and instructions are entirely presented in Chinese, but the file does not offer a language option or ask for user preference. Under the language/locale policy criterion, a fixed language without user opt-in can be a policy issue unless clearly justified and documented.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The trigger keywords are broad common terms related to privacy and compliance, making accidental invocation more likely in ordinary conversations. Unintended activation can cause the agent to apply the wrong skill, access files, generate reports, or run scripts in contexts where the user only wanted discussion-level guidance.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The expanded trigger list remains ambiguous and lacks constraints, which compounds the risk of false activation across many privacy-related discussions. Because the skill can read/write files and launch scripts, accidental routing is more dangerous than for a passive informational skill.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
This markdown file is written entirely in Chinese and does not indicate that language selection is optional or tailored to a specific user preference. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
This code file contains user-facing natural-language content that is exclusively Chinese, beginning in the module docstring and continuing throughout prompts and help text. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified, which is not present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
Natural-language strings throughout the file, including the module description, prompts, and CLI help, force Chinese as the interaction language. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
In interactive mode, the tool collects free-form user responses about GDPR compliance status and then writes them verbatim into a local JSON report. Those responses can easily contain sensitive operational, legal, or personal data, and the script gives no warning, confirmation, redaction step, or file-permission hardening before persisting them, which increases the risk of unintended disclosure on shared systems or through later report handling.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The file’s natural-language interface and descriptions are entirely in Chinese, including the tool name, prompts, and help text, with no indication that the user can select another language. This creates a language/locale policy concern because the skill imposes a specific language without user opt-in or a clearly documented region-specific justification.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The CLI exposes a '--type' option suggesting users can generate different DPIA variants, including an automated-decision template, but the implementation ignores that option and always emits the basic template. In a compliance tool, this can mislead users into believing Article 22-specific safeguards and risk sections were included when they were not, resulting in incomplete regulatory documentation and faulty downstream decisions.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The help text and argument choices imply selectable DPIA types, but the code path never uses args.type. This creates a dangerous integrity gap in a GDPR compliance context because operators may rely on a non-existent feature and produce materially incomplete assessments for higher-risk processing scenarios.
Content
No source excerpt is available for this finding.
Ae4
Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
This code file contains natural-language descriptions and docstrings exclusively in Chinese, including the tool title and usage description. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
Natural-language strings and documentation in this file consistently require Chinese comprehension, including the main description and user-facing output. There is no indication that users can choose another language or that the locale restriction is intentionally limited to a justified region-specific context.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
This finding is valid because the 'security check' script runs other components of the skill, creating code-execution capability inside a tool that users may reasonably expect to be audit-only. In the context of adversarial skill content, this is dangerous because a malicious or compromised checked script could execute harmful local actions when the checker is run.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The script executes commands without prominently informing the user that running the checker will also run other skill programs. That lack of transparency increases the risk of accidental execution of untrusted code during what appears to be a passive review step, especially in a skill ecosystem where content must be treated as adversarial.
Content
No source excerpt is available for this finding.
subprocess module call
Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding
The script invokes other local Python programs with subprocess.run as part of a 'security check'. Even though the commands are hardcoded and do not use shell=True, this still expands the trust boundary from static auditing to active execution of potentially untrusted skill code, which can trigger arbitrary behavior in those scripts during analysis.
Content
Scanner excerpt · scripts/security_check_gdpr.py (reported line 249)May include surrounding context.
python
for cmd in test_commands:
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
