语音Excel编辑助手

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its voice-to-Excel purpose, but it needs review because it can upload audio with an API key, modify workbooks, and install Python packages automatically with weak safeguards.

Install only if you are comfortable sending selected audio recordings to SenseAudio and giving the skill authority to create modified workbook copies. Use a restricted API key, keep SENSEAUDIO_API_BASE fixed to the official endpoint, run it in an isolated Python environment with dependencies preinstalled, and review generated operation plans before allowing destructive spreadsheet edits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:141

Finding

Bearer Token and Audio Disclosure Through an Unrestricted API Endpoint

Content

View full analysis

` header. Consequently, any party able to influence the process environment can redirect sensitive data to an arbitrary endpoint. In addition, `requests.post` follows redirects by default, and the implementation does not explicitly reject or revalidate redirect destinations. ### Attack Path 1. An attacker gains the ability to influence the environment used to launch the Skill, such as through a compromised wrapper, deployment configuration, shell profile, or job definition. 2. The attacker sets `SENSEA ...[truncated 1122 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/main.py:31

Finding

Automatic Runtime Installation of Unpinned Dependencies

Content

View full analysis

None: pip_name = pip_name or import_name try: importlib.import_module(import_name) return except ImportError: print(f"缺少 {pip_name}，正在自动安装...", file=sys.stderr) result = subprocess.run( [sys.executable, "-m", "pip", "install", pip_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, ) if result.returncode != 0: raise RuntimeError( f"自动安装 {pip_name} 失败，请手动执行: {sys.executable} -m pip install {pip_name}\n" f"{result.stderr.strip()}" ) importlib.import_module(import_name) ensure_python_package("requests") ensure_python_package("openpyxl") ``` ### Technical Analysis When either dependency is unavailable, merely loading the script invokes `pip install` for the latest package version resolved by the current Python environment. The installation has no version pinning, lockfile, hash verification, approved index restriction, or user confirmation. Although the package names are fixed and are not directly controlled through command-line input, package resolution still depends on external package-index and local pip configuration. Python package installation may execute package build or setup logic with the same operating-system privileges as the Skill process. This creates a supply-chain boundary inside normal Skill execution and makes the effective code non-reproducible. A compromised package release, package index, mirror, DNS/network path, or pip configuration could cause unreviewed code to execute. ### Attack Path 1. `requests` or `openpyxl` is absent from the runtime environment. 2. An attacker compromises or controls a configured Python ...[truncated 1141 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

- `scripts/main.py`：统一 CLI

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares capabilities that include environment access, file read/write, network access, and shell execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an unnecessary trust gap: the skill can process local files, call external services, and execute commands without a clear least-privilege boundary or reviewer-visible restriction set.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill hardcodes Chinese-language ASR processing (--language zh) without clear user opt-in or justification. This can lead to incorrect transcription of non-Chinese audio, unintended routing of data through a language-specific pipeline, and user confusion about how their content is being processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends uploaded audio to the external SenseAudio ASR service, but the description does not clearly warn the user that their audio leaves the local environment. This can expose sensitive spoken content, names, business data, or regulated information without informed user consent, especially because the workflow is framed as routine file editing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables implicit invocation without defining tight trigger constraints, even though it can transcribe user audio, generate structured edit plans, and modify uploaded Excel workbooks. In this context, automatic invocation increases the chance that ambiguous user requests or conversational references to spreadsheets/voice notes trigger file-modifying behavior without sufficiently explicit user confirmation, which can lead to unintended data changes or unsafe processing of sensitive workbook contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states in Chinese that the agent must follow this protocol, and the entire schema and examples are presented as a fixed Chinese-language interface without any indication that users may choose another language. This appears to impose a language/locale constraint without opt-in or documented justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The schema explicitly supports destructive actions such as deleting rows/columns, clearing cells, and renaming sheets, but it provides no requirement for confirmation, preview, undo, or user warning before execution. In this skill, voice transcription and agent planning sit upstream of workbook modification, so transcription errors or ambiguous instructions could directly cause irreversible spreadsheet changes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L03 states that the skill converts normalized Chinese Excel editing instructions, which imposes a specific language requirement in natural-language guidance. The file does not indicate user opt-in, language selection, or a clearly justified region-specific constraint, so this is a language/locale policy issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Auto-installing Python packages during normal skill execution is not necessary for a voice-to-Excel workflow and expands the trust boundary to external package infrastructure. This creates a direct path for dependency confusion, malicious package delivery, or unauthorized modification of the runtime environment, which is especially dangerous in an agent context that may run with broad file or network access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The script invokes pip at runtime to install packages automatically via a subprocess. Even though the command is not shell-injected, this still introduces supply-chain and environment-tampering risk: execution behavior depends on network package retrieval at runtime, and a compromised package source, mirror, or dependency could lead to arbitrary code execution in the agent environment.

Content

Scanner excerpt · scripts/main.py (reported line 40)May include surrounding context.

python

except ImportError:
        print(f"缺少 {pip_name}，正在自动安装...", file=sys.stderr)

    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", pip_name],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code hardcodes DEFAULT_LANGUAGE = "zh", and command help presents Chinese as the default recognition language. This creates a locale-specific default behavior without explicit user opt-in, which can violate language or locale policy expectations for general-purpose skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script uploads local audio content to an external ASR API without any explicit in-code consent gate, privacy warning, or data-classification check at the transmission point. In environments where audio may contain sensitive business or personal information, this can cause unintended data exfiltration to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code loads an Excel workbook, applies potentially destructive operations such as clearing cells, deleting rows/columns, and renaming sheets, then saves a modified workbook. While the module docstring describes Excel modification generally, there is no direct user-facing warning or confirmation at execution time before these changes are carried out.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The user-facing metadata is in Chinese while the operational prompt is written in English, which can signal a forced or inconsistent language experience rather than offering the user a clear language choice. Under the policy, language constraints should be opt-in or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The plan writes the header value "平均值" directly, which hard-codes Chinese output. Forcing a specific language without offering user choice or documenting a locale-specific constraint is a natural-language policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.