Security audit

L3 Sales Data Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently analyzes its bundled sales data and only has ordinary low-risk packaging and chart-file caveats.

Before installing, understand that the skill is designed for Chinese-language use, installs pandas and matplotlib, reads its bundled sales.csv, and saves chart PNGs in the system temporary directory using fixed names that may overwrite earlier generated charts. It does not show hidden persistence, credential use, remote payload execution, or destructive behavior.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
` and `matplotlib==`. 2. Generate and commit a lockfile containing cryptographic hashes for all direct and transitive dependencies. 3. Configure installation to reject artifacts whose hashes do not match the lockfile. 4. Use an explicitly trusted package index or an internally controlled dependency mirror. 5. Periodically scan pinned dependencies for known vulnerabilities and update them through a reviewed change process. 6. Run dependency installation and skill execution in a restricted environment without unnecessary filesystem, credential, or network access. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: __init__.py:48
Finding: Predictable Chart Filename in a Shared Temporary Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description forces a specific language presentation for the skill metadata, which can violate language/locale policy when no user opt-in or alternative is provided. Nothing in the file indicates that the skill is region-specific or that users can choose their preferred language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The main SKILL.md instructions and parameter descriptions are entirely in Chinese, which imposes a locale/language constraint on users without explicit opt-in. The file does not state that the skill is intentionally limited to Chinese-speaking users or a China-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Natural-language strings, comments, and return values indicate the skill operates exclusively in Chinese, and there is no opt-in or language selection mechanism. This can violate language/locale policy when a skill forces a specific language without offering the user a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: For markdown files, user-facing documentation should warn about behaviors that affect user data or system state. This section states that charts are saved as PNG files, but it does not disclose where files are written, whether existing files may be overwritten, or that local filesystem changes occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill writes a PNG file to the system temporary directory and returns the saved path, but there is no prior warning in comments, docstrings, or user-facing messaging that invoking plotting will create a local file. For code files, file writes should have some visible disclosure unless clearly documented as part of the skill behavior.
Content: No source excerpt is available for this finding.