T09 · Insecure Skill Coding Practices
Warning
- Location
run.py:168- Finding
Untrusted Spreadsheet Values Are Exported Without Formula-Injection Neutralization
- Content
View full analysis
- Remediation
View remediation
Security audit
Community Data Process
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Excel data-processing workflow, but it automatically creates business BI upload workbooks from Downloads with weak safeguards around validation and spreadsheet content.
Install only if you are comfortable with a Chinese-language workflow that reads and writes Excel files in Downloads and produces BI upload workbooks automatically. Review generated files before upload, avoid opening outputs from untrusted source data without spreadsheet protections, and consider adding formula sanitization, audit-failure blocking, output confirmation, and overwrite safeguards before operational use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
run.py:310- Finding
Failed Audit Does Not Prevent Invalid Data from Being Merged
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents execution of a Python script that reads from Downloads, writes cleaned and merged Excel files, and invokes shell commands, but it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: an agent or user may run a file-modifying workflow without clear least-privilege boundaries or review of what filesystem and shell access the skill requires.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill describes generating cleaned output, merge results, and a final BI upload workbook, but it does not clearly warn that execution will create and modify business data files. In a data-processing skill that performs incremental merges without deduplication, lack of an explicit modification warning increases the risk of unintended data corruption, duplicate uploads, or users running the workflow without understanding that persistent BI artifacts will be changed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script automatically writes processed Excel output into the user's Downloads folder without confirmation, dry-run mode, or a safer workspace. In a business-data context, this can silently create or overwrite files, cause users to act on unintended outputs, and leak sensitive operational data into a broadly used directory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The merge step generates an updated BI workbook in Downloads without user confirmation, despite operating on business reporting data that may later be trusted and uploaded. In this workflow context, silent creation of an authoritative-looking workbook increases the risk of accidental data corruption, duplication, or use of stale/incorrect output in downstream reporting.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest frames the skill as an automated Excel data pipeline: filter labels, verify metrics, and incrementally merge into the BI upload table. The notification function adds a separate messaging/integration capability via OpenClaw/Feishu-oriented output, which is not mentioned in the declared purpose and is not an obvious requirement of the core transformation workflow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The natural-language instructions, description, and usage guidance are all presented in Chinese, and the file does not state that the skill is Chinese-only or offer any language selection. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module description and usage instructions are presented only in Chinese, and runtime messaging throughout the script follows the same fixed locale. Under the policy, forcing a specific language without offering user choice can be a natural-language policy violation unless the locale constraint is explicitly justified.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes a bounded workflow of cleaning, auditing, and merging community export data into a BI upload workbook. This block additionally persists a hidden status file with summary metrics for notification purposes, which is not stated in the manifest and is not necessary for the described data-processing objective itself.
- Content
Static analysis
No suspicious patterns detected.