Csv Documentation Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:12 AM UTC
• Version: 1.6.4

Overview

The skill is mainly a CSV validation-document generator, but it also asks for broad agent-wide annotation rules and optional persistent Git-hook behavior that users should review before installing.

Review this skill before installing in a regulated or production environment. Avoid adding its annotation rules to a global AGENTS.md/system prompt unless you intentionally want all future code generation to include @REQ/@TEST markers, avoid global Git hook installation unless that persistent behavior is desired, and prefer pinned dependency setup over the automatic unpinned pip install path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate.py:56

Finding

Automatic Installation of Mutable, Unpinned Dependencies

Content

View full analysis

=1.1.0 openpyxl>=3.1.0 jinja2>=3.1.0 python-dateutil>=2.8.0 ``` ### Technical Analysis When the generator runs outside a virtual environment and the local `.venv` does not already exist, it automatically creates one and invokes `pip install`. The dependencies only specify minimum versions and do not define upper bounds, exact versions, package hashes, or an explicitly trusted package index. Consequently, the effective code installed by the skill can change after the skill itself has been reviewed. A future compromised, mal ...[truncated 1875 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/requirements/linker.py:51

Finding

Git Option Injection Through Unvalidated Commit Argument

Content

View full analysis

Dict[str, Any]: """Get commit information""" try: result = subprocess.run( ["git", "show", commit_hash, "--format=%H%n%an%n%ae%n%B", "-s"], capture_output=True, text=True, cwd=self.project_path, ) if result.returncode == 0: lines = result.stdout.strip().split("\n") ``` ### Technical Analysis Using `subprocess.run()` with an argument array prevents shell metacharacter expansion, but it does not prevent option injection into the invoked program. The supplied `commit_hash` is not validated as a Git object ID and appears before any `--` option terminator. If the supplied value begins with `-`, Git may interpret it as an option rather than as a revision. This allows an untrusted CLI caller to alter the behavior of `git show`. For example, Git supports output-related options that can direct command output to a selected file. The exact effects available depend on the installed Git version and the options accepted by `git show`. The issue is exposed through the `--commit` CLI option. The default path that obtains `HEAD` using `git rev-parse` does not permit this injection. ### Attack Path 1. An attacker obtains the ability to invoke the skill CLI or control the value passed to `--commit`. 2. The attacker supplies a string beginning with a Git option i ...[truncated 1260 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (120)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs operators to modify the agent’s global system prompt so that all skills emit traceability markers in generated code. Cross-skill prompt modification is dangerous because it creates hidden, persistent behavior changes outside this skill’s scope, potentially contaminating unrelated coding tasks and weakening prompt-boundary isolation.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Template version parsing, compatibility checks, migrations, and JSON requirement loading are broader lifecycle-management behaviors than the manifest suggests. While these may be legitimate features, undisclosed file inspection and migration logic can still surprise users and expand the skill's write/read footprint.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · prompts.md (reported line 327)May include surrounding context.

md

---

## 5. Bilingual Output Prompts

### 智能双语模式 (Smart Bilingual)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This function permanently deletes old audit entries and immediately saves the truncated log, with no archival, protection, or immutability controls. In a CSV/GxP/21 CFR Part 11 context, audit trails are compliance-critical records, so deletion can destroy evidence, weaken traceability, and enable concealment of unauthorized or unsafe actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/git-hooks/install.sh (reported line 58)May include surrounding context.

sh

echo "Removing local git hooks..."

    if [ -f "$REPO_ROOT/.git/hooks/$HOOK_NAME" ]; then
        rm "$REPO_ROOT/.git/hooks/$HOOK_NAME"
        echo "Removed $HOOK_NAME hook"
    else
        echo "No local hook found"

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · standards/code-annotations.json (reported line 3)May include surrounding context.

json

{
  "version": "1.0",
  "description": "AI Agent Code Annotation Standards - Central Registry for GxP Compliance",
  "purpose": "Provides unified code annotation conventions that AI agents can follow for traceability in regulated industries (pharmaceutical, medical devices). Skill-agnostic: can be used by any coding skill without coupling.",
  "standards": {
    "requirement_markers": {
      "enabled": true,
      "description": "Markers that link code to requirements traceability",
      "patterns": [
        {"style": "cpp", "pattern": "// @REQ {id} - {description}", "example": "// @REQ URS-001 - System shall supp

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This file's natural-language content is predominantly Chinese, while only a secondary link to an English version is provided. Under the stated policy, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · CHANGELOG_en.md (reported line 65)May include surrounding context.

md

#### Skill Design Philosophy Refactoring
- **SKILL.md simplification**: Reduced from 1034 to ~785 lines, moved prompt content to prompts.md
- **Semantic Action Graph**: New explicit semantic action graph definition showing document generation dependencies
- **prompts.md created**: Critical Thinking Constraints, triggering conditions, and fill prompts moved to separate file
- **SemanticActions class**: New class in generate.py encapsulating dynamically callable capability nodes for AI agents

#### Architecture Changes

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · CHANGELOG_en.md (reported line 81)May include surrounding context.

md

#### Skill Design Philosophy Refactoring
- **SKILL.md simplification**: Reduced from 1034 to ~785 lines, moved prompt content to prompts.md
- **Semantic Action Graph**: New explicit semantic action graph definition showing document generation dependencies
- **prompts.md created**: Critical Thinking Constraints, triggering conditions, and fill prompts moved to separate file
- **SemanticActions class**: New class in generate.py encapsulating dynamically callable capability nodes for AI agents

#### Architecture Changes

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 339)May include surrounding context.

md

#### Skill Design Philosophy Refactoring
- **SKILL.md simplification**: Reduced from 1034 to ~785 lines, moved prompt content to prompts.md
- **Semantic Action Graph**: New explicit semantic action graph definition showing document generation dependencies
- **prompts.md created**: Critical Thinking Constraints, triggering conditions, and fill prompts moved to separate file
- **SemanticActions class**: New class in generate.py encapsulating dynamically callable capability nodes for AI agents

#### Architecture Changes

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · CHANGELOG_en.md (reported line 81)May include surrounding context.

md

#### GAMP 5 Second Edition Compliance
- **M12 Critical Thinking**: Added critical thinking constraints (M12.1~M12.5) guiding AI through systematic risk thinking during validation
- **Document Generation Triggering Conditions**: New trigger condition library defining pre-fill data for VP/URS/FS/RA/IQ-OQ-PQ/VSR
- **Content Fill Prompt Library**: New URS/FS/RA fill prompt templates
- **Data Flow Definitions**: New inter-document data flow rules (VP→RA→FS→Test→VSR automatic traceability)

#### Example Files

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md

#### GAMP 5 Second Edition Compliance
- **M12 Critical Thinking**: Added critical thinking constraints (M12.1~M12.5) guiding AI through systematic risk thinking during validation
- **Document Generation Triggering Conditions**: New trigger condition library defining pre-fill data for VP/URS/FS/RA/IQ-OQ-PQ/VSR
- **Content Fill Prompt Library**: New URS/FS/RA fill prompt templates
- **Data Flow Definitions**: New inter-document data flow rules (VP→RA→FS→Test→VSR automatic traceability)

#### Example Files

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · prompts.md (reported line 210)May include surrounding context.

md

#### GAMP 5 Second Edition Compliance
- **M12 Critical Thinking**: Added critical thinking constraints (M12.1~M12.5) guiding AI through systematic risk thinking during validation
- **Document Generation Triggering Conditions**: New trigger condition library defining pre-fill data for VP/URS/FS/RA/IQ-OQ-PQ/VSR
- **Content Fill Prompt Library**: New URS/FS/RA fill prompt templates
- **Data Flow Definitions**: New inter-document data flow rules (VP→RA→FS→Test→VSR automatic traceability)

#### Example Files

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger conditions and keyword list are broad enough to activate on many ordinary validation-document requests without strong scope boundaries. Overbroad triggering is dangerous in agent environments because it increases the chance the skill is invoked implicitly and performs filesystem or repository-related actions the user did not specifically request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README expands the skill from simple CSV document generation into codebase parsing, requirement extraction, test parsing, Git linkage, and audit-log export. This creates a scope mismatch: an agent invoking the skill for document generation may also gain capabilities to inspect repositories and derive artifacts from source code, increasing data exposure and unintended side effects beyond user expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The cross-skill system-prompt integration asks operators to modify the global system prompt so all code generation includes this skill's annotations. That is dangerous because it extends the skill's influence outside its declared purpose, enabling hidden prompt persistence and indirect behavior changes across unrelated tasks and skills.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:477

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: STANDARDS.md:59