Security audit

Style Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a style analyzer, but it includes an under-documented LLM mode that can send the user’s text to DashScope using an API key.

Review before installing. Use scripts/analyze_style.py for local-only analysis. Only run scripts/analyze_style_llm.py if you intentionally want to send the selected text to DashScope with DASHSCOPE_API_KEY, and avoid confidential drafts, business documents, or personal data unless that external processing is acceptable. Pin dependencies before using this in a sensitive or repeatable environment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The tool’s stated purpose is style analysis, but it sends the full input text to a third-party DashScope endpoint for processing. That creates a real privacy and data-handling risk because users may reasonably expect local analysis and may provide sensitive drafts, proprietary text, or personal data without realizing it is being transmitted externally.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code posts user-provided text to an external API without any explicit runtime warning or consent mechanism. This is dangerous because users may unknowingly expose confidential, regulated, or personal text to a third party, especially in a skill that appears to be a simple analyzer.

Ssd 3

Medium

Confidence: 95% confidence
Finding: On parse failure, the program stores the raw model output in `analysis_notes`, which is then written to YAML and later displayed. Because model output may include echoed user text or sensitive content derived from the input, this fallback can leak private data into logs, terminal output, or saved files beyond the user’s expectations.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich PyYAML requests
Confidence: 94% confidence
Finding: The dependency `rich` is unpinned, so installs may resolve to different versions over time, reducing reproducibility and increasing supply-chain risk if a bad or breaking release is pulled in. While this alone is not an active exploit, it is a genuine security weakness because it weakens version control over third-party code.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich PyYAML requests
Confidence: 98% confidence
Finding: `PyYAML` is unpinned, which is especially risky because the package has a history of serious advisories involving unsafe parsing and input handling. Without a fixed version, the environment may install a vulnerable release or drift unpredictably, making exploitation and incident response harder.

Unpinned Dependencies

Low

Category: Supply Chain
Content: rich PyYAML requests
Confidence: 97% confidence
Finding: `requests` is unpinned, so builds may silently consume versions with known security defects or behavior changes. Because HTTP client libraries often process untrusted network input and credentials, lack of version pinning increases operational and security exposure.

Known Vulnerable Dependency: PyYAML — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: The requirements file includes `PyYAML` without constraining it to a patched release, and static analysis indicates multiple known CVEs affecting some versions of that package. In a text-analysis skill, YAML may plausibly be used for configuration or profile serialization, so if vulnerable parsing paths are present, attacker-controlled YAML could lead to deserialization or input-validation issues with severe consequences.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The file depends on `requests`, and the analyzer reports multiple known advisories affecting some versions of the library. Since this skill may interact with external resources or APIs, a vulnerable HTTP client can expose credentials, mishandle redirects or verification, or otherwise increase risk when processing attacker-influenced URLs or network responses.

Static analysis

No suspicious patterns detected.