It is designed for scenarios that require direct operating system application and in-depth data analysis. [Forced trigger scenario]: - User mentions reading/writing/manipulating Excel, WPS, Word, TXT, Markdown, RTZ, etc. - User wants to "grab", "extract", and "get" data from any application - User needs to perform "in-depth analysis", "trend research", "anomaly detection", and "prediction" on the data - User requests to generate "charts", "visualizations", "dashboards", "data reports" - users say, "Help me see in this document..." Analyze this data...", "Make a chart presentation..." - Any task involving cross-application data flow [Core Competencies]: System interface calls × Data in-depth analysis × Professional visualization IMPORTANT: As long as it involves any of the file operations, data analysis, and visualization, this skill must be used. Don't skip tasks just because they "look simple" - there are many pitfalls in the underlying interface calls, and there are pitfall avoidance guides in the skills.

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:45 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a local document and data-analysis tool, but it asks for overly broad agent control and uses risky desktop automation for user files.

Review before installing. Use this only on files and folders you explicitly choose, avoid untrusted macro-enabled Office/WPS documents, prefer offline parsers for unknown files, and do not paste AGENTS.md into a system prompt unless you want its broad routing rules to control the agent. Check generated output and log files because they may contain source data or sensitive derived information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:15
• Finding: Overbroad Skill Instructions Hijack Agent Routing and User Intent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-16`, `SKILL.md:194-200`, `AGENTS.md:23-29`, `README.md:78-79` **Vulnerability Type**: Agent instruction hijacking through mandatory, overbroad activation rules **Risk Level**: High ### Vulnerable Instruction Snippets The following is an English translation of the relevant instruction segment in `SKILL.md:15-16`: ```text IMPORTANT: Whenever any file operation, data analysis, or visualization is involved, this Skill must be used. Do not skip it because the task "looks simple"—the underlying interface calls contain many pitfalls, and the Skill provides guidance for avoiding them. ``` The following is an English translation of `SKILL.md:194-200`: ```text Do not ask the user what format they want—directly provide the best one. Analyze files immediately after receiving them, visualize the results after analysis, and generate a report after visualization. Leave logs and downloadable output files at every step. When the user says "analyze this," provide a complete data story. ``` The following is an English translation of `AGENTS.md:23-29`: ```text This Skill must be triggered when: - The user wants to operate on any supported file. - The user wants analysis, modeling, prediction, or anomaly detection. - The user wants charts, dashboards, or visualization reports. - The user says phrases such as "analyze this," "read this file," or "make a chart." ``` The relevant instruction in `README.md:78-79`, translated into English, is: ```text For OpenClaw, Claude, or other agents: Use the contents of AGENTS.md as a system prompt in the conversation interface. ``` ### Technical Analysis The Skill does not limit activation to tasks that require its specialized functionality. Instead, it asserts mandatory control over nearly every file operation, data-analysis request, and visualization task. The instructions also direct users to elevate `AGENTS.md` into the system-prompt layer. This increases the autho ...[truncated 2009 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory phrases such as “must use this Skill” and “do not skip.” 2. Restrict activation to explicit user selection or cases where the Skill's specialized functionality is necessary. 3. Do not advise users to install the entire Skill description as a system prompt. 4. Replace the broad trigger with a bounded rule, for example: ```text Use this Skill only when the user explicitly requests supported document parsing, statistical analysis, or visualization and no narrower built-in operation is sufficient. ``` 5. Preserve user intent by asking for clarification when output format, analysis depth, or artifact creation is ambiguous. 6. Make visualization, logging, and report generation opt-in unless they are explicitly requested. 7. State that higher-priority instructions, safety policies, and user constraints always take precedence. 8. Minimize generated artifacts and disclose output paths before writing sensitive derived data. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mac_excel_reader.py:42
• Finding: AppleScript Injection Through Unescaped File and Worksheet Names<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mac_excel_reader.py:42-60` **Vulnerability Type**: Script injection into dynamically generated AppleScript **Risk Level**: High ### Vulnerable Code Snippet ```python def read_excel_applescript(filepath: str, sheet_name: str = None) -> dict: """Read Excel via AppleScript fallback.""" filepath = str(Path(filepath).resolve()) sheet_selector = f'sheet "{sheet_name}"' if sheet_name else 'active sheet' script = f''' tell application "Microsoft Excel" open "{filepath}" set ws to {sheet_selector} of active workbook set data to value of used range of ws close active workbook saving no return data end tell ''' result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True, timeout=120 ) if result.returncode != 0: raise RuntimeError(f"AppleScript error: {result.stderr}") ``` ### Technical Analysis Both `filepath` and `sheet_name` are incorporated directly into AppleScript source using Python string interpolation. Neither value is escaped or passed as a data-only argument. Although `subprocess.run` uses an argument list and does not invoke a shell, this does not prevent injection into the AppleScript language itself. A malicious value containing a quote followed by valid AppleScript syntax can terminate the intended string or worksheet expression and append additional statements. Resolving the file path with `Path.resolve()` normalizes the path but does not remove quotation marks or AppleScript metacharacters. The worksheet name is even more direct because it is inserted into an executable expression: ```python sheet_selector = f'sheet "{sheet_name}"' ``` The vulnerable function is included as the second strategy in the main fallback sequence. It may therefore execute automatically if the `xlwings` strategy fails. ### Attack Path 1. An attacker supplies or influences a file path ...[truncated 1416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never concatenate file paths or worksheet names into AppleScript source. 2. Pass external values through the `osascript` argument vector and retrieve them from `on run argv`. 3. Use a fixed script such as: ```python script = r''' on run argv set inputPath to item 1 of argv set requestedSheet to item 2 of argv tell application "Microsoft Excel" open inputPath if requestedSheet is "" then set ws to active sheet of active workbook else set ws to sheet requestedSheet of active workbook end if set data to value of used range of ws close active workbook saving no return data end tell end run ''' result = subprocess.run( ["osascript", "-e", script, filepath, sheet_name or ""], capture_output=True, text=True, timeout=120, check=False, ) ``` 4. Validate worksheet names against names obtained from the workbook rather than treating a caller-provided name as source code. 5. Reject control characters and unexpected path content before invoking application automation. 6. Prefer `openpyxl` for untrusted workbooks and use AppleScript only after explicit user approval. 7. Add unit tests containing quotes, backslashes, line breaks, and AppleScript keywords in both file and worksheet names. 8. Run automation under the least-privileged account and avoid granting unnecessary Accessibility permissions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/win_excel_reader.py:18
• Finding: Macro-Capable Documents Are Opened Through Desktop Automation Without Disabling Macros<![CDATA[ ## Vulnerability Details **File Location**: `scripts/win_excel_reader.py:18-48`, `scripts/wps_extractor.py:18-60` **Vulnerability Type**: Unsafe opening of untrusted active-content documents through COM automation **Risk Level**: High ### Vulnerable Code Snippets From `scripts/win_excel_reader.py:18-48`: ```python @contextlib.contextmanager def safe_com_session(app_name: str): """COM application safe context manager — ensures process cleanup.""" app = None try: import win32com.client app = win32com.client.Dispatch(app_name) app.Visible = False app.DisplayAlerts = False yield app except ImportError: raise RuntimeError("pywin32 not installed. Run: pip install pywin32") except Exception as e: raise RuntimeError(f"COM session failed [{app_name}]: {e}") from e finally: if app: try: app.Quit() except Exception: pass def read_excel_via_com(filepath: str, sheet_name=None) -> dict: """Read Excel/WPS spreadsheet via COM. Returns dict with sheets data.""" filepath = str(Path(filepath).resolve()) suffix = Path(filepath).suffix.lower() app_name = "KET.Application" if suffix == ".et" else "Excel.Application" result = {} with safe_com_session(app_name) as app: wb = app.Workbooks.Open(filepath) ``` From `scripts/wps_extractor.py:18-60`: ```python @contextlib.contextmanager def wps_com_session(app_name: str): """WPS COM session context manager.""" app = None try: import win32com.client app = win32com.client.Dispatch(app_name) app.Visible = False if hasattr(app, 'DisplayAlerts'): app.DisplayAlerts = False yield app finally: if app: try: app.Quit() except Exception: pass def extract_wps_spreadsheet(filepath: str) -> dict: """Extract data from WPS Spreadsh ...[truncated 3335 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer offline parsers such as `openpyxl` for all untrusted Excel files. 2. Reject macro-enabled formats such as `.xlsm` by default unless the user explicitly approves desktop automation. 3. Before opening a workbook through Microsoft Office COM, save the previous automation-security value and force macros to be disabled: ```python previous_security = app.AutomationSecurity try: app.AutomationSecurity = 3 # msoAutomationSecurityForceDisable wb = app.Workbooks.Open(filepath) finally: app.AutomationSecurity = previous_security ``` 4. Set the security option before any untrusted document is opened. 5. Verify the equivalent macro-disable mechanism for each supported WPS application. If WPS does not provide a reliable automation-security control, do not open untrusted files through WPS COM. 6. Isolate desktop automation in a disposable virtual machine, sandbox, or low-privilege account without sensitive files or credentials. 7. Block outbound network access for the automation process where practical. 8. Detect macro-bearing Office containers before opening them and require explicit confirmation. 9. Do not rely on `DisplayAlerts = False` as a security control; it only suppresses user-interface prompts. 10. Add security tests using harmless open-event macros to verify that active content cannot execute through each supported reader. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (59)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger conditions are so broad that they effectively force this skill to activate for almost any routine file-reading, writing, or analysis request. That creates an unsafe routing policy: a high-privilege, system-operating skill may be invoked even when simpler, lower-privilege handling would suffice, increasing the chance of unintended file access, cross-application actions, and over-collection of user data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 描述将该 skill 定位为一个通用的系统级应用操作与深度分析工具，强调系统接口调用、跨应用数据抓取、广泛文档类型操控和可视化输出；但代码仅实现了对少数结构化文件格式（CSV、Excel、JSON）的读取，本地数据分析，以及结果写入到 JSON/Markdown 文件。它没有控制其他系统应用、没有从任意应用抓取数据、没有生成图表或仪表盘，也没有实现声明中提到的多种文档格式操控。虽然“深度数据分析”部分与代码行为部分吻合，但整体描述显著夸大了能力范围，主用途也更偏向离线表格/数据文件分析而非系统级跨应用操作，因此属于明显不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个覆盖“系统接口调用 + 深度分析 + 专业可视化”的综合型 skill，强调任何文件操作、数据分析、可视化任务都必须调用。但代码只实现了文件解析与结构化导出：根据扩展名加载本地文件内容，提取表格、段落、文本、Markdown 标题、RTZ 任务、CSV、JSON 等，再打印并保存解析结果。其主要目的明显是“读取并解析文档”，而非“直接操作系统应用”或“深度数据分析/可视化”。虽然声明中提到文件读取/写入与某些支持格式，这与代码部分吻合，但大量核心能力在代码中完全不存在，且“强制触发场景”远超代码实际范围。因此描述对能力边界有显著夸大，属于实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 描述把该 skill 定义为一个覆盖文件操作、系统应用调用、深度分析和专业可视化的通用能力，并宣称凡涉及文件操作/数据分析/可视化都必须使用它。但代码块的实际功能明显更窄：它只读取 Excel 内容，且主要针对 macOS 环境，通过 Excel 应用接口或 openpyxl 获取表格数据，然后写出 JSON。代码中没有任何统计分析、建模、异常检测、预测、可视化或报告生成逻辑，也没有对除 Excel 之外的文件类型或应用进行处理。因此，声明的核心能力与代码实际行为存在明显夸大和用途偏差。虽然“文件读取”和“系统接口调用”部分与代码有一定相关性，但整体描述远超代码真实能力，属于实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个广泛的系统接口调用 + 数据分析 + 可视化综合技能，强调文件操作、跨应用数据流转、数据抓取和深度分析。然而给出的代码块只是一个独立的可视化引擎：从 JSON 文件加载已生成的分析结果，构建固定 2x2 dashboard，并导出 HTML/PNG。它不与 Excel/WPS/Word/TXT/Markdown/RTZ 等应用交互，不抓取外部应用数据，不进行底层系统接口调用，也没有真正执行异常检测、趋势预测或其他分析逻辑。虽然“生成图表/可视化/仪表盘”这一小部分与声明有重合，但整体声明明显远超代码实际能力，且主用途从“综合数据操作分析技能”收缩为“分析结果可视化导出器”，因此属于明显不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个覆盖面很广的“系统接口调用 × 数据深度分析 × 专业可视化”技能，适用于几乎所有文件操作、跨应用数据流转、分析和可视化任务。但代码块的核心行为非常具体且有限：读取 Excel/WPS 工作簿内容，并将结果打印/保存为 JSON。虽然这属于声明中“文件读取”和部分“跨应用读取”的一个子集，但代码的主要目的与声明的主打能力明显不一致，尤其缺失深度分析和可视化等关键能力。此外，声明列出多种文件格式与应用场景，而代码仅支持 Excel/WPS 电子表格。因此该描述明显夸大了实际能力，构成实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 描述将该 skill 定位为一个通用的系统应用操作 + 深度分析 + 专业可视化工具，并强调凡是文件操作、数据分析、可视化都必须使用。然而给定代码的核心功能非常具体且有限：它只在 Windows/WPS COM 环境下打开 .et 和 .wps 文件，提取工作表单元格数据、文档文本、表格和少量元数据，然后打印并写出 JSON。虽然这与“从应用中提取数据”这一小部分声明相符，但主要宣称的深度分析、趋势/异常/预测、图表可视化、报告生成、广泛文件类型支持等均未体现。因此描述明显夸大了能力，主用途也比实际代码宽泛得多，构成实质性不匹配。

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger rules are so broad that they would capture routine file handling, analysis, or visualization requests, effectively forcing use of a system-level skill in many ordinary situations. That expands the blast radius of any unsafe behavior in the skill, including file writes, command execution, and logging of user data, even when a safer narrower tool would suffice.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The entire skill specification is written as a Chinese-only operating contract for agents and includes Chinese-specific assumptions such as Chinese font installation guidance, but it does not state that language is optional or user-selectable. This can constitute a language/locale policy issue because it effectively constrains agent behavior to a specific language without user opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill mandates writing multiple artifacts to disk for every analysis task without requiring user consent or warning that files will be created. This can lead to silent persistence of sensitive data, accidental overwrites, storage of derived reports in insecure locations, and unexpected data exposure on shared systems.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises system file access plus automatic report/output generation but does not warn that the skill may read local documents and write derived artifacts containing sensitive data. In a security-sensitive agent context, omission of these warnings can lead to accidental exposure, persistence of sensitive content, and unsafe handling of private files.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Cursor (Personal Skill)

```bash
mkdir -p ~/.cursor/skills/system-data-intelligence
git clone https://github.com/zhaojie911272507/system-data-Intelligence.git \
  ~/.cursor/skills/system-data-intelligence
```

• Confidence: 83% confidence
• Finding: The installation instructions clone the repository into a persistent agent skill directory under ~/.cursor/skills, causing the capability to remain available across sessions. In the context of a skill that performs system file access and cross-application data operations, persistent installation increases the risk of long-lived unintended access if the skill is over-broad or later updated unsafely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
pip install pdfplumber
sudo apt install libreoffice-nogui fonts-noto-cjk
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
pip install pdfplumber
sudo apt install libreoffice-nogui fonts-noto-cjk
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
pip install pdfplumber
sudo apt install libreoffice-nogui fonts-noto-cjk
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
pip install pdfplumber
sudo apt install libreoffice-nogui fonts-noto-cjk
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Linux
pip install pdfplumber
sudo apt install libreoffice-nogui fonts-noto-cjk
```

---

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README states the skill will automatically apply for very broad triggers such as reading files, extracting data, analysis, or visualization, without any scope limits, consent checks, or exclusions for sensitive locations. In an agent setting, this increases the chance of over-broad activation that causes unintended access to local documents or cross-application data handling beyond the user's precise intent.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes shell execution and file-writing behaviors but does not declare any explicit tool scope or permissions boundary. In a skill intended to operate on user files and system applications, this increases the chance of over-privileged execution, unexpected file modification, or command use beyond what a caller would reasonably expect.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Core activation and usage instructions are written as mandatory behavior in Chinese, and the document includes locale-specific assumptions such as Chinese content/font guidance, without offering an opt-in language choice. This can amount to a language/locale policy violation because the skill appears to impose a specific language context rather than adapting to user preference.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 关键注意点
- Linux 无 COM/AppleScript，一律用 Python 库离线解析
- 老格式文件先用 LibreOffice headless 转换再读取
- 中文内容需要安装 CJK 字体：`sudo apt install fonts-noto-cjk`

> 详细 API 手册 → [references/linux-api.md](references/linux-api.md)

• Confidence: 88% confidence
• Finding: The skill recommends a sudo-based package installation command as part of normal operation guidance. In a skill that may be invoked automatically for common file tasks, introducing privileged commands increases the risk of unnecessary elevation, system modification, and unsafe operator behavior, especially if users or agents follow the guidance blindly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates generating files, reports, structured outputs, and logs without requiring user awareness or consent about where data will be written or retained. For user-supplied documents, this can create unintended persistence of sensitive content, accidental overwrites, and artifact sprawl containing private information.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly requires persistent operation logs and multiple output artifacts derived from user task data. In the context of file parsing and data analysis, those logs and reports may contain sensitive contents, metadata, filenames, or extracted records, creating a clear data leakage and retention risk if stored in plain language or predictable output directories.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown reference uses Chinese throughout headings, tables, comments, and examples, but does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The section heading and the entire reference are presented in Chinese, and the document does not indicate that another language can be used. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Static analysis

No suspicious patterns detected.