customer-segment-eng

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:49 AM UTC
• Version: 1.0.0

Overview

This skill performs a legitimate customer segmentation task, but it can duplicate sensitive banking customer data into output files more broadly than the instructions disclose.

Review this skill before installing in environments with real banking, financial, or personally identifiable customer data. Use a controlled output directory, avoid opening generated CSVs with formula execution enabled, and prefer a version that exports only needed fields or masks identifiers by default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/segment.py:298

Finding

Excessive Export of Sensitive Financial Customer Data

Content

View full analysis

Vulnerability Details

File Location: scripts/segment.py, lines 298-300
Vulnerability Type: Excessive sensitive-data replication and insecure output handling
Risk Level: Medium

Vulnerable Code

python

# Save results
out_csv = os.path.join(output_dir, 'segmentation_results.csv')
df.to_csv(out_csv, index=False, encoding='utf-8-sig')

Technical Analysis

The script writes the entire working DataFrame to segmentation_results.csv. This DataFrame retains the original input columns and adds derived segmentation fields. Consequently, the exported file may contain customer identifiers, balances, transaction information, dates, demographic attributes, branch details, and any other columns present in the source CSV.

This behavior exceeds the documented result-table scope, which only requires the customer identifier, cluster, and segmentation label. No column allowlist, data minimization, masking, explicit approval, retention policy, or output permission control is applied before the export.

Because the output directory is controlled through a command-line argument, sensitive information can be copied into a shared, broadly readable, synchronized, or otherwise insufficiently protected location.

Attack Path

1. A customer CSV containing personal and financial information is supplied to the segmentation script.
2. The script loads the complete CSV and retains its original columns in df.
3. Clustering and derived columns are added to the same DataFrame.
4. The operator selects, or is induced to select, a shared or weakly protected output directory.
5. The complete DataFrame is written to segmentation_results.csv.
6. A user or process with access to that directory obtains a duplicated copy of all customer records, rather than only the intended segmentation fields.

Impact Assessment

This issue does not grant additional operating-system privileges or code execution. Its impact is on c ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

Apply data minimization by exporting an explicit allowlist of required fields:

python

export_columns = [
    'customer_id',
    'cluster',
    'cluster_rank',
    'segment_label',
]
available_columns = [c for c in export_columns if c in df.columns]
df[available_columns].to_csv(
    out_csv,
    index=False,
    encoding='utf-8-sig',
)

Additional hardening should include:

• Require explicit user approval before exporting any original financial or demographic fields.
• Mask or pseudonymize customer identifiers when direct identification is unnecessary.
• Create output files with restrictive permissions appropriate to the operating system.
• Reject or warn about output directories that are shared, world-readable, or outside an approved location.
• Document retention and secure-deletion requirements for generated reports.
• Log which fields were exported without logging their sensitive values.
• Keep raw source data and reduced analytical outputs in separately controlled locations.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/segment.py:298

Finding

CSV Formula Injection in Segmentation Results

Content

View full analysis

Vulnerability Details

File Location: scripts/segment.py, lines 298-300
Vulnerability Type: CSV formula injection
Risk Level: Medium

Vulnerable Code

python

# Save results
out_csv = os.path.join(output_dir, 'segmentation_results.csv')
df.to_csv(out_csv, index=False, encoding='utf-8-sig')

Technical Analysis

The output includes original, user-controlled string values without neutralizing spreadsheet formula prefixes. Cells beginning with characters such as =, +, -, or @ may be interpreted as formulas when the generated CSV is opened in spreadsheet software.

Standard CSV quoting does not reliably prevent formula evaluation because spreadsheet applications can still treat a quoted CSV field as a formula after parsing it. An attacker able to influence any retained input field—such as a customer identifier, gender, branch, or an unrecognized source column—can insert a spreadsheet formula into the generated result.

The exact consequences depend on the spreadsheet product and its security configuration. Possible effects include external network requests, disclosure of spreadsheet data, deceptive hyperlinks, and exploitation of dangerous or legacy spreadsheet functionality.

Attack Path

1. An attacker supplies or modifies a source CSV field so that its value begins with a spreadsheet formula marker, for example =HYPERLINK(...).
2. load_and_clean() retains that source column and value in the DataFrame.
3. The complete DataFrame is exported to segmentation_results.csv without formula neutralization.
4. An analyst opens the generated file in spreadsheet software.
5. The spreadsheet application interprets the attacker-controlled cell as a formula.
6. Depending on the formula, application, and security settings, the analyst may be directed to attacker-controlled content or the application may perform an external request that leaks information.

Impact Assessment

No server ...[truncated 484 chars]

Remediation

View remediation

Remediation Suggestions

Neutralize formula-like values in every string column before CSV export:

python

def neutralize_csv_formula(value):
    if isinstance(value, str) and value.startswith(('=', '+', '-', '@')):
        return "'" + value
    return value

safe_df = df[available_columns].copy()
for column in safe_df.select_dtypes(include=['object', 'string']).columns:
    safe_df[column] = safe_df[column].map(neutralize_csv_formula)

safe_df.to_csv(out_csv, index=False, encoding='utf-8-sig')

Additional controls should include:

• Apply sanitization after all transformations and immediately before every CSV export.
• Use an export format that supports explicit text cell types when spreadsheet consumption is required.
• Restrict exports to the minimum required columns, reducing the number of attacker-controlled fields.
• Add automated tests covering values beginning with =, +, -, and @, including values preceded by whitespace or control characters.
• Warn users that generated CSV files may contain untrusted source data and should be opened with external-content and formula execution disabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are broad enough to activate on generic phrases like 'analyze customers' or on routine uploads of banking-related tables, which can cause the skill to run without sufficiently specific user intent. In this context, the skill processes sensitive financial customer data and generates derived outputs, so unintended activation increases the risk of unnecessary handling, transformation, and persistence of regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill states it will produce multiple files derived from uploaded customer data but does not clearly warn users beforehand that sensitive financial information and segment labels will be written to disk. Because the outputs include customer IDs, cluster assignments, summaries, charts, and reports, this can expand data exposure through unintended retention, downstream sharing, or storage in less protected locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The plotting configuration hard-codes Chinese font families (WenQuanYi Micro Hei, SimHei) for rendered output. This imposes a locale-specific presentation choice without offering user opt-in or documenting that the skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The plotting configuration hard-codes Chinese font preferences (WenQuanYi Micro Hei, SimHei) for all generated charts. This imposes a language/locale preference in the skill behavior without giving the user a choice or documenting that the tool is region-specific.

Content

No source excerpt is available for this finding.