universal-data-analyst

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:56 PM UTC
• Version: 1.0.3

Overview

This is a real data-analysis skill, but it can run generated or caller-supplied Python and access databases without enough safeguards, so it needs review before install.

Install only if you are prepared to treat generated analysis scripts as untrusted code: review them before running, run them in a sandbox or disposable environment, avoid sending sensitive data samples to external LLMs, use read-only database credentials, and do not pass arbitrary local paths as chart files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: orchestrator.py:417

Finding

Unrestricted Execution of LLM-Generated Python Scripts

Content

View full analysis

Dict[str, Any]: """Step 6: Execute analysis script.""" # ... if script_path and os.path.exists(script_path): print(f"🚀 Executing analysis script: {script_path}") try: result = subprocess.run( [sys.executable, script_path], capture_output=True, text=True, cwd=str(self.session_dir) ) print(result.stdout) if result.stderr: print("⚠️ Warning:", result.stderr) results["status"] = "Execution successful" results["executed"] = True results["script_output"] = result.stdout ``` ### Technical Analysis The workflow intentionally asks an LLM to generate a complete executable Python script and then permits a caller to execute an arbitrary existing `script_path`. The script is not authenticated, inspected, restricted to the session directory, or validated against an import or ...[truncated 2414 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: report_generator.py:737

Finding

Arbitrary Local-File Disclosure Through Unrestricted Chart Embedding

Content

View full analysis

str: """Embed charts into HTML using Base64 encoding.""" if not chart_files: return "" html = '

\n' html += '

Visual charts

\n' for chart_path in chart_files: chart_file = Path(chart_path) if not chart_file.exists(): continue try: with open(chart_file, 'rb') as f: img_data = base64.b64encode(f.read()).decode('utf-8') # Determine the MIME type from the extension ext = chart_file.suffix.lower() mime = 'image/png' if ext == '.png' else 'image/jpeg' if ext in ['.jpg', '.jpeg'] else 'image/svg+xml' caption = chart_file.stem.replace('_', ' ').replace('-', ' ').title() html += f'''

{caption}

''' except Exception as e: html += f'

Chart loading failed: {e}

\n' ``` ### Technical Analysis The public report-generation interface accepts a list of chart paths and reads every path that exists. It does not require the target to reside beneath the report's chart directory, verify that it is a regular file, reject symlinks, validate an image signature, or impose a file-size limit. A non-image file is still read completely and embedded in the HTML. Any extension other than PNG or JPEG is labeled as SVG, so extension handling does not provide an effective security boundary. Base64 encoding is not encryption or sanitization. Anyone who can access the generat ...[truncated 1755 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: report_generator.py:918

Finding

Stored HTML Injection in Generated Analysis Reports

Content

View full analysis

\n' html += '

Entity type identification

\n' html += f'

\n' html += f'

{ontology.get("entity_type", "Pending")}

\n' html += f'

{ontology.get("entity_type_reason", "")}

\n' html += '

\n\n' ``` ```python for dim in ontology.get('core_dimensions', []): html += f'{dim.get("dimension", "")}{dim.get("description", "")}\n' ``` ```python exec_summary = analysis_results.get('executive_summary', []) if exec_summary: for item in exec_summary: html += f'

\n' html += f'

{item}

\n' html += '

\n' else: findings = analysis_results.get('findings', []) for finding in findings[:5]: html += f'

\n' html += f'

{finding}

\n' html += '

\n' ``` ```python if isinstance(content, list): for item in content: html += f'

• {item}

\n' elif isinstance(content, dict): html += '\n\n' for key, value in content.items(): html += f'\n' html += '

{key}

{value}

\n' else: html += f'

{content}

\n' ``` ```python conclusions = analysis_results.get('conclusions', []) if conclusions: for conclusion in conclusions: html += f'

\n' html += f'

{conclusion}

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: README.md:65

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (49)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · llm_analyzer.py (reported line 180)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · llm_analyzer.py (reported line 408)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · llm_analyzer.py (reported line 526)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · llm_analyzer.py (reported line 626)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · main.py (reported line 387)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · main.py (reported line 580)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · main.py (reported line 730)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · main.py (reported line 777)May include surrounding context.

python

# result = call_llm(prompt)
        # return parse_ontology_result(result)

        return prompt  # 返回提示词供上层调用

    def plan_analysis(self, ontology: OntologyResult, user_intent: str,
                     data_sample: str, column_details: List[str]) -> AnalysisPlan:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The orchestrator presents itself as mainly generating prompts for manual LLM use, but it also contains a built-in path to execute a supplied Python script. That mismatch is security-relevant because users may trust the tool as non-executing while it can in fact run attacker-controlled or LLM-generated code, enabling code execution with the privileges of the current user.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code executes an externally supplied script path without a confirmation step, safety review, or trust boundary enforcement. Given the surrounding workflow encourages saving LLM-produced code to disk and then running it, this substantially increases the risk of executing malicious or unsafe code that can access local files, credentials, and the environment.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · FLOW_HEALTH_MONITOR_GUIDE.md (reported line 149)May include surrounding context.

需要手动调用LLM的提醒

text

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
【重要提醒】
⚠️  本体识别需要调用大模型完成！
⚠️  提示词已保存到: session_xxx/step2_ontology_prompt.txt

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · FLOW_HEALTH_MONITOR_GUIDE.md (reported line 155)May include surrounding context.

需要手动调用LLM的提醒

text

⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️⚠️
【重要提醒】
⚠️  本体识别需要调用大模型完成！
⚠️  提示词已保存到: session_xxx/step2_ontology_prompt.txt

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README presents the skill instructions and usage entirely in Chinese, with no indication that users can choose another language. This can constitute a language/locale policy issue when the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to send generated prompts and likely dataset-derived content to an external LLM API, but does not warn that uploaded or summarized data may leave the local environment and be processed by a third-party provider. In a data-analysis skill, this omission is security-relevant because users may assume purely local processing and inadvertently expose sensitive business or personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and overlap with ordinary user requests such as 'help me analyze this data' or 'explore this dataset,' making accidental invocation likely. Because this skill can proceed to script generation and execution, unintended triggering increases the chance of processing sensitive files or launching high-impact actions without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states it will generate executable Python scripts, run them, produce files, and support SQL database connections, but it does not clearly warn the user about these high-impact behaviors or request consent. In an LLM-driven workflow, code execution and external data access materially raise the risk of unsafe operations, data exposure, filesystem writes, and misuse of credentials if triggered on untrusted input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is natural-language content, and it appears entirely in Chinese, including headings, explanations, and examples. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This Python file contains user-facing natural-language strings and documentation entirely in Chinese, including the title, prompts, and usage guidance. Under the policy rule for language/locale, this is a violation because the skill presents a fixed language experience without documenting a user choice, opt-in, or justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language descriptions and user-visible output exclusively in Chinese, including the module docstring and later printed status/error messages. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation unless the scope is explicitly region-specific or configurable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Database connectivity and arbitrary query execution are not justified by the stated purpose of a file loader and violate least-privilege expectations for such a component. In a larger agent system, this mismatch can cause downstream tools or users to trust the skill with file-only inputs while it actually has network/database reach, increasing the chance of abuse or accidental exposure of sensitive records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module is presented as a generic file loader, but it also accepts a connection string and executes arbitrary SQL via pd.read_sql(sql_query, engine). In an agent-skill context, this materially expands the capability surface from passive file parsing to active database access, which can enable unintended data exfiltration or destructive queries if untrusted input reaches sql_query or connection_string.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The SQL code path consumes a raw connection string and query without any explicit warning, confirmation, or policy checks before creating an engine and transmitting credentials/query text to a database. In agent environments this can silently send sensitive connection details or retrieve confidential data, especially if parameters are supplied by another tool, prompt, or untrusted workflow input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file embeds its primary user-facing descriptions and reporting text exclusively in Chinese, including the module description and later generated report strings. Under the policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cleaning report is internally inconsistent: it subtracts recommended row deletions from the total, but still states the retained row count as '100%' and says all original data is preserved. This can mislead downstream users or agents into believing no destructive action is being recommended, causing unsafe data-processing decisions, audit inaccuracies, or unintentional data loss when deletion actions are later applied.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains user-facing natural-language instructions and descriptions entirely in Chinese, including the module purpose and all generated prompt templates. Because the skill does not provide any opt-in, fallback, or documented reason for restricting output language, it creates a locale policy issue under the rule for forced language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.