Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its stated local data-analysis purpose, but it ships a vulnerable Parquet/Arrow parsing dependency in a tool meant to process local files, so it should be reviewed before installation.
Install only if you are comfortable with a paid platform authorization check and local workspace persistence. Avoid processing untrusted Parquet/Arrow files until the pyarrow pin is upgraded to a patched version, and treat the delete command as a permanent local dataset removal operation.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
Creating virtual environments, installing packages, validating releases, and running doctor checks are privileged setup behaviors far beyond ordinary local analytics. If not clearly disclosed and tightly scoped, they increase supply-chain and host-modification risk under a misleadingly simple description.
The runtime pins pyarrow==21.0.0, and the supplied advisory indicates a use-after-free issue in Apache Arrow when reading IPC data. This skill explicitly processes local data files, including Parquet/Arrow-related formats, so a crafted local file could plausibly trigger memory corruption in native Arrow components during parsing.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
The lockfile pins pyarrow==21.0.0, and the finding reports a known high-severity use-after-free vulnerability in Apache Arrow when reading crafted IPC data. This skill is specifically intended to analyze local CSV/JSON/XLSX/Parquet data, so it is plausible that untrusted or externally sourced data could be processed; if vulnerable parsing paths are reached, this could cause process crashes and potentially memory corruption with code-execution implications depending on exploitability.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
# Submitted SQL executes only after DuckDB external access is disabled.
connection.execute("SET enable_external_access=false")
row_limit = int(limits["max_rows"]) + 1
cursor = connection.execute(
f"SELECT * FROM ({sql}) AS _bounded_query_result LIMIT {row_limit}"
)
columns = [
The allowed operation set includes "dataset.delete", which exceeds the manifest's stated read-only local analysis/reporting scope. Exposing destructive capability in an authorization client for a read-only skill creates clear risk of scope creep, misuse, or future code paths enabling deletion under the guise of harmless analysis.
The skill declares no explicit tool scope or permissions even though its documented behavior includes environment-variable access, local file reads/writes, and network communication. This weakens transparency and reviewability, increasing the chance that users or hosts will authorize broader capabilities than expected.
The manifest description and the entire user-facing skill documentation are presented exclusively in Chinese. Under the policy criteria, forcing a specific language without an explicit user choice or opt-in is a natural-language policy violation.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- 发布构建器只接受真实、无凭据的 HTTPS origin、非空 Ed25519 公钥映射，以及与规范化公钥 JSON 匹配的 SHA-256。
- 发布物包含公钥，不包含签名私钥。Runner 会把内嵌公钥 bundle 与盖章 SHA-256 再次匹配。
- `SHA256SUMS` 覆盖发布文件；构建器与安装器都验证。缺少盖章、占位 origin、空 trust、哈希不符或被篡改时拒绝。
- 安装器仅支持 macOS/Linux；WSL2 走 Linux 分支。只允许 Python 3.12/3.13、用户拥有的真实目录和包内 `.venv`，不使用 sudo 或系统 site-packages。
## 稳定错误
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
PYTHON_BIN="./runtime/.venv/bin/python"
WORK_DIR="${TMPDIR:-/tmp}/sql-data-analyst-example"
mkdir -p "$WORK_DIR"
chmod 700 "$WORK_DIR"
sha256_file() {
if command -v sha256sum >/dev/null 2>&1; then
sha256sum "$1" | awk '{print $1}'
The CLI performs remote authorization and ticket verification for paid operations before executing ostensibly local data analysis. That creates an unexpected network dependency and causes local dataset metadata and content-derived fingerprints to be sent to a platform service, which conflicts with the stated local/read-only use case and broadens the trust boundary unnecessarily.
The skill exposes a delete command even though the described use case is local analysis and read-only SQL/report generation. This expands the capability from analysis into destructive state changes, creating a risk of unintended or unauthorized dataset removal by callers who trust the documented read-only behavior.
The code initializes a platform client using an API key from the environment, enabling external service access not expected for a local SQL analysis tool. In this context, environment-sourced credentials plus hidden remote access increase the risk of secret misuse, unintended data disclosure, and behavior that operators may not anticipate.
The delete method removes a dataset tree by unlinking files and removing directories recursively, which is a destructive and potentially irreversible operation. While the implementation is careful, this file provides no confirmation prompt, user-visible logging, or explicit warning comment/docstring on the deletion behavior.
The module for a supposedly local, read-only data analysis skill performs outbound authorization and billing requests to a remote platform, which materially expands the trust boundary and contradicts the stated capability. This creates privacy, transparency, and policy risks because local analysis inputs are indirectly tied to remote service usage and billing without clear justification in the skill description.
The remote authorization path introduces external network dependency and billing logic into a skill advertised for local SQL/data analysis, creating an unexpected channel for metadata disclosure and operational control by a third party. Even if only fingerprints and identifiers are sent, this undermines the user's expectation of purely local execution and increases attack surface.
The code rejects any authorization response whose billing currency is not exactly "CNY". This hard-coded locale/currency constraint is a natural-language policy concern because it forces a specific regional setting without any visible user choice or justification in the file.
This markdown file is entirely written in Chinese and does not indicate that users can choose another language or locale. Under the natural-language policy rule, forcing a specific language without user opt-in is a policy concern unless the locale restriction is clearly documented and justified.
No suspicious patterns detected.