Back to skill

Security audit

光伏设计NASA日均气象数据获取

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it says: geocode a user-provided location when needed, fetch NASA POWER weather and energy data, and save an Excel file, with normal location-sharing privacy caveats.

Before installing, be aware that place names or precise addresses may be sent to OpenStreetMap Nominatim for geocoding, and coordinates are sent to NASA POWER for data retrieval. Use direct coordinates if you want to avoid sharing a full address with the geocoder, and choose the output path carefully because the script writes an Excel file there. The generated workbook uses Chinese worksheet labels.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared behavior says the skill fetches NASA POWER data, but the workflow also sends user-supplied locations to OpenStreetMap Nominatim for geocoding. This mismatch can mislead users and reviewers about third-party data disclosure and network behavior, which is especially sensitive when users provide precise addresses.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill performs network operations but does not declare any tool scope or permissions boundary. In an agent environment, this weakens reviewability and consent controls because the skill can access external services without an explicit capability declaration.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The trigger examples are exclusively Chinese and the documented Excel sheet names are also in Chinese, but the skill does not state that it is a China-specific skill or offer users an option to use another language. This can violate language/locale policy because it imposes a specific language without opt-in or justification.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill instructs users to provide a location name or exact coordinates, then transmits that data to a third-party geocoding service without an upfront warning. This creates a privacy risk because addresses and coordinates may reveal home, workplace, or other sensitive locations to an external provider.

Session Persistence

Medium
Category
Rogue Agent
Content
def write_excel(output_path, monthly_feature, daily_feature, climatology_feature):
    """Write data to Excel with openpyxl."""
    try:
        import openpyxl
        from openpyxl.styles import Font, Alignment, PatternFill, Border, Side
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest describes a skill that fetches NASA POWER meteorological data and outputs Excel files, but this helper script also sends user-provided location names to the OpenStreetMap Nominatim geocoding API. Geocoding may be a useful implementation detail, but it is a distinct external data source and behavior not reflected in the manifest’s stated scope.

Context-Inappropriate Capability

Medium
Confidence
81% confidence
Finding
The stated purpose is limited to fetching NASA POWER meteorological data for wind and solar energy and producing Excel output. This code adds a capability to transmit arbitrary location strings to a separate external geocoding service, which is not mentioned in the manifest and is not obviously implied by the narrow description as written.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
This code contains multiple non-English natural-language strings in inline comments and later uses Chinese worksheet/header names, which imposes a specific language/locale without any opt-in or alternative. Under the policy, forcing a locale is a violation unless the tool clearly offers a language choice or documents a justified region-specific constraint.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The generated workbook uses Chinese labels such as the date header and sheet titles, which affects end-user output and forces a specific locale. There is no indication that users can choose their preferred language or that the tool is intentionally limited to a Chinese-language context.

Static analysis

No suspicious patterns detected.