钢材货源查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

This steel-trading skill is broadly coherent, but its cloud publishing path can send inventory and contact data to a fixed Feishu table without enough user-specific control.

Review before installing. Use this only if you intend to share steel inventory and contact details through the documented marketplace, replace the Feishu destination with one you control, disable or explicitly configure scheduled pushes, and install dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/inventory_market_cloud.py:14

Finding

Fixed External Feishu Table May Receive Sensitive User Data

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unbounded Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

=2.28.0 beautifulsoup4>=4.11.0 lxml>=4.9.0 openpyxl>=3.1.0 pandas>=2.0.0 ``` The documented installation command is: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis All dependencies use open-ended lower bounds. Consequently, the exact code installed is determined at installation time by the active package index and dependency resolver, rather than by a reviewed and reproducible lock file. No package hashes, exact version pins, upper bounds, isolated environment requirement, or trusted-index restriction is provided. The package names are recognizable and the audit found no evidence that they are intentionally malicious or typographically deceptive. The vulnerability is the mutable and unverifiable installation process. Python packages and their transitive dependencies may execute code during installation, wheel loading, or later import. A compromised package release, compromised index, dependency substitution, or incompatible future release could therefore introduce code that was not present during the Skill audit. ### Attack Path 1. A user follows the documented `pip install` command. 2. pip contacts the configured package index. 3. The resolver selects the newest versions satisfying the lower bounds, including transitive dependencies. 4. An unreviewed, compromised, or substituted package artifact is downloaded. 5. Package installation or import-time code executes with the privileges of the user running pip. ### Impact Assessment Successful dependency compromise could execute arbitrary code with the installing user's privileges. Depending on the installation environment, this may permit: - Reading or modifying files accessible to the user - Accessing environment variables and application credentials - Mod ...[truncated 336 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_price_excel.py:94

Finding

Spreadsheet Formula Injection in Price Report Export

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (59)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch specifically notes local persistence of price history and related data without clear disclosure. In a business context, silent local storage of operational data can create confidentiality and retention risks, especially when users may assume the skill is only performing ephemeral queries.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger set includes broad everyday terms, making accidental activation likely. In this skill, activation can lead to shell commands, file handling, external lookups, or publication workflows, so overbroad triggers increase the chance that unrelated user messages initiate high-impact operations or collect data without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill's inventory publication flow includes contact names and phone numbers for public posting, yet the documentation does not adequately warn users that this information may be disclosed to others. In a B2B marketplace context, accidental exposure of personal or business contact data can lead to privacy violations, scraping, spam, and targeted social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The Feishu integration section documents direct reads and writes to an external platform using a specific app token and table ID, but does not warn users about external transmission, storage, or sharing boundaries. This creates a substantial risk of unintended disclosure of business inventory and contact information to a third-party service or wider audience than expected.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

column_map is built with Chinese standard keys such as 价格, but the import loop later accesses column_map["price"]. This mismatch causes a runtime exception during import, so a crafted or even normal Excel upload can reliably trigger a denial of service for the import workflow and prevent inventory ingestion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares broad capabilities including shell execution, file read/write, and network access but does not define any explicit tool scope or permissions boundaries. In this context, the documentation instructs the agent to run scripts, save uploaded files, write Excel output, and access external services, so the lack of least-privilege constraints materially increases the chance of unauthorized file access, command execution, or data exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Vague trigger descriptions with unclear activation boundaries can cause the skill to engage in contexts the user did not intend. Because this skill advertises actions involving uploads, imports, external data sources, and inventory publication, ambiguous activation materially raises the risk of privacy mistakes and unintended operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

对话风格指南以中文礼貌用语和固定中文措辞作为回复规范，但未说明是否可根据用户偏好切换语言或地区表达方式。按照政策要求，若强制单一语言而不给用户选择，属于语言/locale 约束不充分披露的问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to upload Excel inventory files, save them to a temporary directory, and import them, but it does not warn about file contents, storage, validation, or downstream effects. Inventory spreadsheets often contain sensitive business data, and unclear handling increases the risk of confidential data exposure, unintended persistence, or processing of malicious files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill instructs persistent scheduled execution via crontab, which creates ongoing autonomous behavior beyond the immediate user session. In a skill that performs network access, file operations, and data pushes, persistence increases the blast radius of misconfiguration or abuse and may continue transmitting data without fresh user intent.

Content

Scanner excerpt · SKILL.md (reported line 390)May include surrounding context.

设置定时任务：

bash

# 每天 9:00 推送
crontab -e
# 添加：
0 9 * * * cd /workspace/projects/workspace/skills/steel-price-query && python scripts/push_daily.py

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration fixes the default region to 唐山 and default steel types to Chinese-language values, which imposes a specific locale/domain context by default. For all file types, hard-coded language or locale constraints should either be optional, user-selectable, or clearly justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template enables scheduled push delivery by default and already includes a concrete WeChat target plus predefined market queries. In a B2B trading skill, this can cause unintended outbound messaging, privacy leakage, or silent notifications to real recipients once the skill is deployed with minimal review, especially if users or operators assume the template is inert.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language content entirely in Chinese, including the module docstring and later CLI descriptions and output strings, with no option for users to select another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains only Chinese-language docstrings, argument descriptions, and console output, which imposes a specific language on all users. Under the policy, locale constraints should either be optional/opt-in or clearly documented as region-specific and justified; that justification is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When replace_existing is enabled, the script silently removes prior inventory for matching suppliers before completing the new import. In a B2B inventory platform context, accidental or malicious triggering can cause unintended data loss and business disruption, especially because there is no confirmation, preview, or rollback.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.