T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils/template_engine.py:477- Finding
Path Traversal Allows Filesystem Reads and Arbitrary File Overwrites
- Content
View full analysis
- Remediation
View remediation
Security audit
PIPL-Compliance（PIPL合规工具）
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a local PIPL compliance helper, but its security and feature claims do not consistently match the shipped code and its file-write boundaries need review.
Review before installing. Treat this as a Chinese/PIPL-oriented local drafting and checklist aid, not legal advice or proof of compliance. Run it only on files you intentionally provide, verify generated reports with counsel, avoid exposing the template helper to untrusted input, and pin dependencies yourself if reproducibility matters.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:2- Finding
Unbounded Jinja2 Dependency Contradicts Version-Pinning Claims
- Content
View full analysis
=3.1.6 ``` The comment is translated into English here for report consistency; the operative dependency declaration is unchanged. ### Technical Analysis The requirement `jinja2>=3.1.6` is a lower-bound constraint, not an exact version pin. It permits pip to install any future Jinja2 version satisfying that condition. Therefore, the installed code may differ from the dependency version originally audited. This creates a supply-chain integrity and reproducibility weakness. A future compromised release, security regression, or incompatible release could be selected without any corresponding change to the Skill package. The issue is especially relevant because `SKILL.md` and `requirements.txt` explicitly claim that all dependencies are version-pinned. No evidence was found that Jinja2 itself is malicious or that the project uses a typosquatted package. The finding concerns insufficient version control rather than a currently confirmed malicious dependency. ### Attack Path 1. A user follows the documented installation procedure and runs `pip install -r requirements.txt`. 2. pip queries the configured package index and resolves the newest available Jinja2 release matching `>=3.1.6`. 3. The selected release may be newer than the version reviewed by the Skill publisher. 4. If that future release is compromised or contains a relevant regression, its code executes when `document-generator.py` imports and uses Jinja2. ### Impact Assessment The potential impact depends on the behavior of the dependency version selected at installation time. A compromised dependency could execute with the same privileges as the user running the ...[truncated 393 chars]- Remediation
View remediation
``` 2. Use hash verification to bind installation to exact reviewed artifacts: ```text jinja2== \ --hash=sha256: ``` 3. Generate and commit a lock or constraints file covering transitive dependencies, not only direct dependencies. 4. Perform dependency updates through an explicit review process that includes vulnerability scanning, compatibility testing, and lock-file regeneration. 5. If a broad version range is intentional, remove or correct all claims that every dependency is pinned. 6. Align the fallback installation message in `scripts/document-generator.py`, which currently recommends another broad range, with the project's approved dependency policy. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Claiming self-audit, DPIA-like workflows, cross-border compliance checks, and a dedicated small-processor audit without implementing them can materially mislead users. In a security/compliance context, overclaiming functionality is itself a trust and safety issue because it can suppress appropriate human review.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The changelog contains materially inconsistent security and scope claims: newer entries say cross-jurisdiction features and out-of-scope scripts were removed, while older entries in the same file still advertise those capabilities as active. In a security-sensitive compliance skill, this can mislead reviewers or users about the actual trusted feature set and whether deprecated or risky components may still exist, increasing the chance of unsafe deployment decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The primary description is presented in Chinese and the README does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified as region-specific compliance behavior.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Overly broad trigger keywords can cause unintended invocation of the skill in normal privacy or business discussions. In an agent ecosystem, that can expose sensitive local files or generate misleading compliance output in contexts where the user did not intend to run the tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Stray code fragments embedded in documentation can confuse downstream agents, users, or tooling about what should be executed and what the skill actually does. While not directly exploitable by itself, it increases the risk of accidental execution paths, parser confusion, and trust boundary erosion in agentic environments.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The permission boundary says scripts do not read outside the project directory, but documented usage requires reading user-specified input files. This inconsistency can cause users and reviewers to misunderstand the actual file-access scope, weakening trust in the least-privilege claim.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This file is entirely written in Chinese and is presented as a general privacy-policy template for all products and services, but it does not state that it is specifically for a China-only audience or provide any user language choice. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language description is entirely in Chinese and presents the skill as a Chinese-language compliance tool without offering any language choice or opt-in. Under the policy, forcing a specific language is a violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire guide is written in Chinese and does not indicate that users may choose another language or that the language restriction is intentional. Under the policy rule for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue unless the constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code's user-facing natural-language content, including the module docstring and class docstring, is written only in Chinese. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The warning and interactive prompt text shown to users is hard-coded in Chinese, and there is no indication that users can choose another language. This constitutes a language/locale policy issue because the skill imposes a specific language in user-facing interactions without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module title, docstrings, CLI help text, severity labels, and report output are all presented exclusively in Chinese, which imposes a fixed language on users. The file does not indicate any opt-in, locale selection, or region-specific justification for this constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This file is a code file, so only SQP-2 and SQP-3 apply. The natural-language content at L089-L090 states that the disclaimer is governed by the laws of the People's Republic of China and disputes go to the developer's local court, but the template also references multiple jurisdictions such as GDPR and CCPA and does not present this jurisdiction choice as optional or region-specific. That creates a locale/jurisdiction policy concern because it forces a specific legal locale without clear user opt-in or a documented scope limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The generated HTML explicitly sets
lang="zh-CN", which forces a specific language/locale in the output. The file does not offer any user opt-in or configuration for locale selection, and no region-specific justification is documented here.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file description and embedded templates are entirely in Chinese and specifically target PRC PIPL compliance, with no option for users to choose another language or locale. This creates a language/locale policy concern because the skill effectively imposes a single language and jurisdictional framing by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file’s natural-language descriptions and user-facing error messages are entirely in Chinese, including the CLI/tool description, without indicating that the user can choose another language. This is a language/locale policy concern because the skill appears to impose a specific language by default rather than offering opt-in or documenting a clear region-justified restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest advertises the new "small_processor_audit" scenario as based on 24 audit items, but the code comment and scenario description explicitly say "19项审计框架" and enumerate 19 checks. This is an intent/documentation contradiction within the skill artifacts that can mislead users about the scenario’s actual coverage.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language descriptions and user-facing help text entirely in Chinese, beginning with the module docstring and continuing throughout the CLI messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
generate_data_mapping的签名和文档字符串表明它接收包含activities的映射对象并生成“数据映射报告”，但main在读取 JSON 后会把任何顶层字典在 L319-L320 强制转换为列表，再在 L336-L337 将该列表传给generate_data_mapping。这会使最符合该函数文档预期的输入形态被破坏，并触发if not mapping_data or 'activities' not in mapping_data的错误分支，和代码注释/文档所表达的意图相矛盾。- Content
Static analysis
No suspicious patterns detected.