T09 · Insecure Skill Coding Practices
Warning
- Location
document_processing.py:15- Finding
Predictable Shared Temporary Directory Enables Symlink-Based File Overwrite
- Content
View full analysis
- Remediation
View remediation
Security audit
Document Processing
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches document-processing work, but its instructions describe automatic Feishu cloud syncing of document contents without clear opt-in or data-transfer boundaries.
Review this skill before installing if you process sensitive documents. Use it only with documents you are comfortable sending to Feishu, or disable/avoid the Feishu workflow unless uploads are explicit. Avoid running batch conversions in shared systems with the default temp directory, and do not open generated CSV files from untrusted spreadsheets without formula protections.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
document_processing.py:56- Finding
Spreadsheet Formula Injection in Generated CSV Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises automatic synchronization of documents and extracted results to Feishu cloud services, but provides no warning that document contents may be transmitted to an external platform. In a document-processing context, files may contain sensitive business or personal data, so silent cloud forwarding materially increases the risk of unintended data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code creates and saves a new DOCX file, which is a file write operation covered by the missing-warning rule for code files. While there are docstrings describing functionality, there is no explicit warning, confirmation, or user-facing disclosure that the skill will write output files to the provided path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function opens the destination path for writing and emits converted spreadsheet contents, which is a safety-relevant file write. The file contains no user-facing warning, confirmation, or explicit notice that this operation will create or replace a file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This routine constructs output paths under the temp directory and performs repeated conversions, resulting in multiple file creations. Although errors are printed, there is no warning or notice to the user that batch execution will generate files in /tmp/document_processing by default.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Saving the generated Word document is a file write operation that can affect user data if the target path already exists. The code lacks any confirmation, warning, or explicit user-facing notice about this write action.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The main descriptive text is written in Chinese, which can force a specific language experience on users without opt-in. The file does not indicate that the skill is intentionally region-specific or provide an alternative language option.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The module docstrings, class docstrings, and user-facing messages are written exclusively in Chinese, and the file provides no indication that users can choose another language. Under the language policy rule, forcing a single language without opt-in can be a policy concern unless the locale constraint is explicitly justified.
- Content
Static analysis
No suspicious patterns detected.