T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:16- Finding
Broad mandatory activation and forced workflow override agent autonomy
- Content
View full analysis
- Remediation
View remediation
Security audit
System Data Intelligence — File · Analysis · Visualization
Security checks for vulnerabilities and agentic risk
Overview
This is a broad data-processing skill, but it asks to activate too widely and can expand simple requests into file reading, analysis, network/database access, and persistent report output without clear user control.
Review this skill before installing. Use it only where broad data processing is intended, require explicit approval before reading sensitive files, querying databases, calling APIs, or writing reports, and avoid opening untrusted Office/WPS documents through desktop automation. Do not rely on its masking as complete privacy protection; run it in a contained environment for sensitive work.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mac_excel_reader.py:42- Finding
AppleScript injection through unescaped workbook paths and sheet names
- Content
View full analysis
dict: """Read Excel via AppleScript fallback.""" filepath = str(Path(filepath).resolve()) sheet_selector = f'sheet "{sheet_name}"' if sheet_name else 'active sheet' script = f''' tell application "Microsoft Excel" open "{filepath}" set ws to {sheet_selector} of active workbook set data to value of used range of ws close active workbook saving no return data end tell ''' result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True, timeout=120 ) if result.returncode != 0: raise RuntimeError(f"AppleScript error: {result.stderr}") return {sheet_name or 'Sheet1': result.stdout.strip()} ``` The reference documentation contains the same construction pattern: ```python def numbers_to_xlsx(numbers_path: str, output_path: str): script = f''' tell application "Numbers" open POSIX file "{numbers_path}" set doc to front document export doc to POSIX file "{output_path}" as Microsoft Excel close doc end tell ''' subprocess.run(['osascript', '-e', script], check=True, timeout=60) ``` ### Technical Analysis The workbook path, sheet name, and documented conversion paths are inserted directly into executable AppleScript source. No AppleScript string escaping or input validation is applied. Using a subprocess argument list prevents shell metacharacter interpretation by a shell, but it does not prevent injection into the AppleScript program passed to `osascript`. An attacker-controlled quote can terminate the intended string or selector and append addit ...[truncated 1393 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/win_excel_reader.py:41- Finding
Untrusted Office and WPS documents are opened without enforced macro suppression
- Content
View full analysis
dict: """Read Excel/WPS spreadsheet via COM. Returns dict with sheets data.""" filepath = str(Path(filepath).resolve()) suffix = Path(filepath).suffix.lower() app_name = "KET.Application" if suffix == ".et" else "Excel.Application" result = {} with safe_com_session(app_name) as app: wb = app.Workbooks.Open(filepath) logger.info(f"Opened: {filepath}") sheets_to_read = [wb.Sheets(sheet_name)] if sheet_name else list(wb.Sheets) for ws in sheets_to_read: ws_name = ws.Name raw = ws.UsedRange.Value if raw is None: result[ws_name] = [] elif isinstance(raw, tuple) and isinstance(raw[0], tuple): result[ws_name] = [list(row) for row in raw] else: result[ws_name] = [list(raw)] wb.Close(False) ``` ```python def extract_wps_writer(filepath: str) -> dict: """Extract content from WPS Writer (.wps) via KWPS COM.""" filepath = str(Path(filepath).resolve()) result = {'text': '', 'tables': [], 'metadata': {}} with wps_com_session("KWPS.Application") as app: doc = app.Documents.Open(filepath) result['text'] = doc.Content.Text try: result['metadata'] = { 'author': doc.BuiltInDocumentProperties("Author").Value, 'pages': doc.ComputeStatistics(2), } except Exception: pass ``` ```python def read_excel_xlwings(filepath: str, sheet_name=None) -> dict: """Read Excel via xlwings (requires Excel for Mac).""" import xlwings as xw filepath = str(Path(filepath) ...[truncated 1998 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/security_utils.py:49- Finding
Sensitive-data scanning and masking omit numeric columns and values after the first 100 rows
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api_loader.py:20- Finding
Unrestricted API URLs allow server-side request forgery
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (60)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill defines extremely broad mandatory trigger conditions that activate on common file extensions and generic verbs like 'read', 'analyze', or 'process'. In an agent setting, this can cause the skill to seize control for many ordinary tasks, expanding access to files, databases, and APIs beyond what is necessary and increasing the chance of unintended sensitive data handling.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个能力范围极广的综合型系统技能，涵盖文件处理、分析、可视化、数据库、API 和敏感数据处理等多个领域；但提供的代码块只对应其中很小的一部分，即 API 接入与数据拉取。虽然代码确实支持 API 请求、分页、重试、鉴权及将 JSON 转为 DataFrame/CSV，这与“API 接入”部分一致，但并未实现描述中大多数核心能力，也没有体现“强制触发场景”所声称的广泛适用性。因此，代码的实际主要用途与声明的总体用途存在明显不匹配，属于描述显著夸大能力范围。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个多能力、广触发范围的综合型技能，涵盖文件读写、深度分析、可视化、数据库、API 和敏感数据处理等多个领域。但实际代码仅与数据库连接和 SQL 查询相关，属于其中“数据库连接”这一子能力的窄实现。虽然代码包含少量文件输出能力（将查询结果写为 CSV），也有对数据库 URL 打码的辅助函数，但没有实现文件解析、深度数据分析、建模预测、异常检测、可视化、API 调用或正式的脱敏处理。其主要用途与声明中的“全能型数据处理系统级 Skill”存在明显范围不符，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个覆盖面很广的通用系统级数据处理 skill，但给定代码仅实现了其中一小部分：本地结构化数据文件加载与统计分析。代码支持 .xlsx/.xlsm/.xls/.et、.csv、.json 的读取，进行数据质量、分布、相关性、异常值和简单时间序列分解分析，并输出分析结果。它没有任何数据库、API、可视化、敏感数据脱敏/安全处理相关实现，也没有通用文件编辑或更广泛文件格式处理能力。虽然描述中提到“数据分析、异常检测”等与代码部分吻合，但整体声明显著夸大了能力范围，且主定位为多能力系统级 agent skill，与实际单一分析脚本不符，因此应判定为描述与行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个覆盖面很广的系统级数据处理技能，包含分析、可视化、数据库、API 和安全脱敏等核心能力；但提供的代码仅实现了文件解析与导出 JSON，且范围局限于若干本地文件格式的读取。代码没有任何数据库连接、网络/API 调用、图表生成、统计分析/建模、异常检测或脱敏逻辑。尽管“文件操作”这一子能力与描述部分重合，但声明把该 skill 定位为多能力综合系统，而实际代码的主要用途只是通用文档解析器，属于显著的描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个覆盖多类数据工作流的通用系统级技能，能力范围非常广，包括多种文件格式、分析建模、可视化、数据库、API 和敏感数据处理。但提供的代码块功能明显更窄：它只读取 Excel 文件内容，并在 macOS 环境下通过 xlwings、AppleScript 或 openpyxl 进行回退读取，随后导出 JSON。本代码没有体现任何分析、可视化、数据库访问、API 调用、脱敏或其他文件格式处理能力。虽然“文件操作”中的一部分（Excel 读取）与声明有局部重合，但声明的主要目的和强制触发范围远超代码实际行为，因此描述不能准确代表该代码块。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个覆盖面很广的通用数据处理与集成型 skill，但提供的代码块功能范围非常窄，核心是“敏感数据处理 + 临时资源清理”。代码中没有看到任何 Excel/Word/CSV/JSON 等文件读取解析逻辑，没有数据分析、建模、预测、异常检测实现，没有任何可视化库调用，没有数据库连接代码，也没有 HTTP/API 请求逻辑。因此其主要用途与声明的主要用途存在实质性不一致。虽然声明中包含“脱敏/敏感数据/隐私处理/数据安全”，这部分与代码一致，但不足以支撑其对文件操作、分析、可视化、数据库、API 等广泛能力的整体宣称。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个覆盖数据工作流多环节的综合型系统技能，适用于文件读写、分析建模、数据库、API、安全脱敏等广泛任务；但提供的代码是一个非常聚焦的可视化引擎。其核心行为是：读取 analysis_result.json、根据已有字段（如 distributions、anomalies、correlations、quality、time_series）绘制四宫格仪表盘，并导出 HTML/PNG。虽然其中展示了“异常数”“相关矩阵”“缺失率”等分析结果，但这些结果显然是输入提供的，代码本身并未执行对应的数据分析流程。代码访问的资源也仅限本地文件系统，不涉及数据库、外部 API 或隐私处理逻辑。因此，声明与实际行为在主要用途和能力范围上存在明显不匹配，属于过度声明且主用途不同。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
该描述把 skill 定义成一个通用的数据处理系统级能力集合，触发范围极广；但所给代码块的实际功能非常单一，核心仅是读取 Windows Excel/WPS 文件内容，并在 COM 失败时使用 openpyxl 兜底，再保存为 JSON。虽然这属于“文件操作”中的一个子能力，且“自动降级”与代码中的 COM→openpyxl 回退相符，但整体声明的主要能力集合与代码行为严重不对等。代码没有实现分析、建模、预测、异常检测、可视化、数据库、API、脱敏等关键声明能力，因此描述不能准确代表该代码块的实际作用。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是一个大而全的通用数据处理技能，覆盖分析、建模、预测、异常检测、可视化、数据库、API、安全脱敏以及多种文件格式。实际代码却高度专用，仅实现了 WPS Spreadsheet (.et) 和 WPS Writer (.wps) 的内容抽取，并将结果保存为 JSON。它没有实现任何数据分析、建模、预测、异常检测、图表生成、数据库访问、API 调用、爬取接口、脱敏或隐私保护逻辑；也不支持声明中列出的 Excel/WPS/Word/TXT/Markdown/RTZ/CSV/JSON 等广泛格式中的大多数，仅支持两种 WPS 格式。因此，代码的真实能力与声明用途存在明显且实质性的不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述了一个功能非常广泛的系统级技能，但实际代码片段只是一个空的 Python 包初始化文件，不包含任何与声明能力对应的实现，也看不出触发逻辑、资源访问或支持性基础设施。其实际行为与声明的核心用途严重不符，因此应判定为描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a comprehensive system-level skill with wide operational scope across files, analytics, visualization, databases, APIs, and privacy/security processing. However, the provided code chunk only contains unit tests for a data analysis component. It does not itself implement file handling, chart generation, database access, API calls, desensitization, or any system-level trigger/orchestration logic. While the tested module appears related to data analysis, the actual code shown is narrowly focused on validating analysis outputs rather than providing the broad declared functionality. This is therefore a material description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad, system-level skill covering file operations plus analysis, visualization, databases, APIs, and privacy/security processing. However, the provided code chunk only contains unit tests for document parsing/loading utilities, mainly around reading local files and fallback behavior. There is no evidence in this chunk of database access, API integration, charting, reporting, sensitive-data processing, or advanced analytics/modeling. While the file-loading aspect partially aligns with the declared file-operation capability, the actual code's primary purpose is much narrower: testing parser functions rather than implementing the broad multifunctional agent skill described. This is a material description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
声明描述的是一个覆盖面很广的数据处理与系统集成型 skill，但实际代码片段只是 tests/test_security_utils.py 的测试用例，聚焦于 DataMasker 和 SecureCleanup 的安全相关辅助功能验证。代码仅能支持“敏感数据处理/脱敏”和“安全清理”这一小部分声明内容，而且还是以测试形式出现，不是实际执行这些广泛任务的主功能实现。根据评估标准，当代码的主要目的与声明的主要用途存在实质差异时，应判定为不匹配。这里的主要不匹配在于：声明强调多领域通用数据处理 Agent，而实际行为仅是安全工具测试。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a broad, system-level skill covering file manipulation, deep analysis, visualization, database access, API usage, and privacy-sensitive data processing. However, the provided code chunk is only a test module for visualization utilities. It checks that create_dashboard and create_network_graph return figures for simple sample inputs. While this loosely aligns with the visualization portion of the description, the actual code shown does not implement the advertised broad capabilities and has a materially different immediate purpose: automated testing. Therefore, the description does not accurately represent what this specific code chunk actually does.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates invocation for an extremely broad set of commonplace tasks, including generic file handling, analysis, visualization, database access, APIs, and privacy-related work. In context, this broad forced-trigger behavior expands the attack surface and can route benign user requests into a high-privilege skill that can write files, access networks, and invoke shell-based helpers, increasing the chance of overreach, data exposure, or unintended side effects.
- Content
Known Vulnerable Dependency: pytest==8.3.0 — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The dependency pins pytest to 8.3.0, which the advisory data marks as vulnerable to tmpdir handling issues. Because pytest is listed under testing rather than runtime functionality, the issue is real in the dependency set but likely limited to development or CI contexts unless tests run in sensitive shared environments.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions are written as direct operating guidance for any agent and require the file to be loaded and executed as-is, but they do not provide any language or locale opt-in. This effectively imposes Chinese as the operating language without offering the user a choice or stating a region-specific justification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction not to skip the skill even when a task 'looks simple' weakens normal agent discretion and creates ambiguous activation boundaries. That increases the likelihood that the skill will run on low-risk requests where its broad automation could unnecessarily read user files or generate outputs without need.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
df = api.fetch_paginated("/items", page_param="page", per_page=100, data_key="data")
CSV 格式接口
df = api.fetch_csv_to_df("https://data.example.com/export.csv")
api.close()
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The output specification requires automatic generation of multiple files, and earlier sections instruct immediate parsing and analysis of received files without user-facing notice or consent. This is dangerous because it normalizes implicit file access and disk writes, which can expose sensitive contents, overwrite expectations about data handling, and leave residual artifacts on the system.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux 系统依赖
bash sudo apt install libreoffice-nogui fonts-noto-cjk
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux 系统依赖
bash sudo apt install libreoffice-nogui fonts-noto-cjk
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux 系统依赖
bash sudo apt install libreoffice-nogui fonts-noto-cjk
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux 系统依赖
bash sudo apt install libreoffice-nogui fonts-noto-cjk
Static analysis
No suspicious patterns detected.