节日查询

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:54 AM UTC
• Version: 1.0.0

Overview

The skill itself is a local festival/date lookup tool, but its setup instructions ask users to modify the host Python environment with unpinned packages.

Review the install step before using this skill. Prefer installing only the needed dependency in a virtual environment with pinned versions, and avoid running the provided `--break-system-packages` command on a shared or system Python installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned System-Wide Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable code snippet:

bash

pip install --break-system-packages zhdate holidays

Technical Analysis

The setup instructions install zhdate and holidays without version constraints or integrity hashes. Consequently, the packages and their transitive dependencies are resolved to mutable versions from the configured Python package index at installation time. A compromised package release, dependency, index configuration, or network/package-distribution channel could therefore introduce code that was not reviewed as part of this Skill.

The --break-system-packages option bypasses Python's externally managed environment protection and permits modification of the host Python installation. This increases the potential scope of dependency conflicts and host-environment damage. In addition, holidays is not imported or otherwise used by scripts/festival_query.py, so its installation unnecessarily expands the supply-chain attack surface.

The audited Python script itself performs local calendar calculations and contains no observed remote payload retrieval, command execution, persistence, credential collection, or data-exfiltration behavior.

Attack Path

1. A user or Agent follows the dependency-installation instruction in SKILL.md.
2. pip resolves the latest available, unpinned versions of the named packages and their transitive dependencies using the configured package index.
3. An attacker compromises a package release, dependency, package-index account, mirror, or local index configuration.
4. The malicious package content is downloaded and installed without hash verification.
5. Malicious installation or imported package code executes with the privileges of the account running pip.
6. Because installation targets the host environment rather ...[truncated 861 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unused holidays package from the installation instructions.
2. Pin zhdate and every transitive dependency to reviewed versions.
3. Require package hashes, preferably through a locked requirements file generated from a trusted environment:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

4. Populate requirements.txt with exact versions and validated SHA-256 hashes.
5. Remove --break-system-packages and install dependencies only in a dedicated virtual environment or isolated container.
6. Review and periodically scan locked dependencies for known vulnerabilities and unexpected ownership or release changes.
7. Configure installation to use a trusted package index and avoid untrusted extra indexes that could enable dependency-confusion attacks.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

For all file types, language-policy issues should be flagged when a skill forces a specific language without user opt-in. The module title and user-facing descriptions are entirely in Chinese, and the file does not indicate that the skill is region-specific or provide any language/locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.