PDCA+ISO9001质量管理

• Outcome: Review
• Latest audit: May 28, 2026 · 1:25 PM UTC
• Version: 1.0.0

Overview

This quality-management skill mostly matches its stated purpose, but it needs review because saved rules can be evaluated as Python expressions and report output paths are not safely constrained.

Install only after reviewing or disabling the eval-based rule handling, and treat the knowledge base as persistent local storage. Use trusted project and rule inputs, avoid storing secrets or sensitive customer data, sanitize HTML report content, and restrict report filenames to safe basenames before use.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

eval() call detected

High

• Category: Dangerous Code Execution

Content

for key, value in context.items():
                    condition = condition.replace(f"${key}", str(value))
                # 执行条件判断（简化实现）
                if eval(condition, {"__builtins__": {}}, {}):
                    rule['trigger_count'] += 1
                    matched_rules.append(rule)
                    # 更新触发次数

• Confidence: 99% confidence
• Finding: The code evaluates rule conditions from stored JSON using Python eval() after only doing string substitution. Even with __builtins__ removed, dynamic evaluation of attacker-controlled expressions is unsafe and can still enable denial of service, logic manipulation, and potentially sandbox bypasses depending on interpreter behavior and reachable objects. In this skill, rules are persisted and auto-generated from project data, which increases the chance that untrusted input can reach the evaluator.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill advertises executable Python components and clear file read/write behavior, but the manifest does not declare corresponding permissions or data-access expectations. This weakens the trust boundary for users and hosting systems, because the skill can persist or access local data without explicit disclosure or policy gating.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose frames the skill as quality-management assistance, but the described implementation includes persistent storage, auto-learning, notification behavior, and especially rule evaluation using eval() against context data. That mismatch hides materially risky behaviors from users and operators, and eval-based rule execution can become code-injection or arbitrary command-execution if untrusted rule/context data is accepted.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: This is a real logic flaw: the code checks mandatory status with `self.CHECK_ITEMS.get(result.name, {})`, but `result.name` contains localized display names like `信息真实性校验` rather than internal keys like `information_authenticity`. As a result, mandatory failures are silently missed in `_assess_risk_level` and `_generate_summary`, causing underreported risk and weaker required-action/warning generation for decisions that should be treated as higher risk.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The rule-evaluation feature executes persisted rule conditions dynamically, which grants stored data control over program logic. That capability is unnecessary for basic quality-management matching and becomes more dangerous here because rules can be auto-extracted from project data and later executed without strong validation, enabling malicious or malformed rule expressions to alter behavior or exhaust resources.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The HTML conversion pipeline inserts report content directly into HTML without escaping untrusted fields such as project names, summaries, issues, and decision content. Because those values are attacker-controlled in many realistic workflows, a crafted value containing HTML or script-capable markup can become active content in the generated report, leading to stored XSS or malicious HTML execution when the report is viewed.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The function is described as a simple Markdown-to-HTML converter, but it does not remove or neutralize raw HTML already present in the markdown content. This mismatch is security-relevant because callers may assume the routine produces passive output, while embedded attacker HTML is preserved and rendered in the final report.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The save_report method joins a user-influenced filename directly with the reports directory and does not normalize or validate traversal sequences. An attacker can supply names like '../../some/target' or absolute-path variants to overwrite files outside the intended report directory, which can lead to arbitrary file write within the process permissions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly mentions automatic knowledge-base generation, archival, and experience extraction, but it does not warn that project content may be retained locally over time. This creates a confidentiality and privacy risk because sensitive decision context, reports, or operational history may be stored beyond the user's expectation and later reused or exposed.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/knowledge_manager.py:284