评优激励通报分析2.0

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:05 AM UTC
• Version: 2.0.1

Overview

The skill mostly does what it claims, but it handles sensitive local business spreadsheets and writes exported reports with weak path controls and an Excel formula-injection risk.

Install only if you are comfortable letting it read the specified local Excel and Word policy files and create persistent reports. Use an isolated working folder, set explicit output paths, avoid relying on YJ_SRC from an old session, and treat generated XLSX files carefully until formula-prefix sanitization and pinned dependencies are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gen_warn.py:92

Finding

Spreadsheet Formula Injection in Warning List Export

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Non-Reproducible Installation Due to Incompletely Pinned Dependencies

Content

View full analysis

=3.0 python-docx>=0.8.11 matplotlib>=3.5 ``` The documented installation command installs dependencies using these lower-bound-only constraints: ```text pip install -r requirements.txt ``` ### Technical Analysis All three dependencies are legitimate packages, and the audit found no evidence that the named packages are malicious. However, constraints using only `>=` allow pip to install future versions that were not present when the Skill was reviewed. This makes the environment non-reproducible and permits the effective dependency code to change without any modification to the Skill repository. Transitive dependencies are also left unpinned. A future compromised, malicious, or incompatible release could therefore be selected during installation. The issue is a supply-chain hardening weakness rather than evidence of an active dependency-confusion attack. The package names are not apparent typosquats, and no untrusted package index is configured in the audited files. ### Attack Path 1. A user follows the installation instructions and runs `pip install -r scripts/requirements.txt`. 2. Pip queries its configured package index and resolves the newest versions satisfying the lower bounds. 3. A newly published or compromised direct or transitive dependency is selected. 4. Dependency-controlled code may execute during installation or later when the scripts import the package. 5. Such code runs with the privileges of the user performing the installation or executing the Skill. This path requires compromise or malicious publication in the dependency supply chain; no such compromise was demonstrated during the audit. ### Impact Assessment If a resolved dependency were compromised, it could potentially: - Read files available to the installing or execu ...[truncated 469 chars]

Remediation

View remediation

python-docx== matplotlib== ``` For stronger integrity and reproducibility: 1. Generate a lock file containing all direct and transitive dependencies. 2. Include SHA-256 hashes and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Configure installation to use an approved package index explicitly. 4. Build and test dependencies in an isolated virtual environment. 5. Review dependency updates before changing the lock file. 6. Run vulnerability and license scans against the fully resolved dependency graph. 7. Avoid installing dependencies with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个覆盖 Excel 分析与政策 Word 文档检索的综合技能，并明确包含菜单式交互、具体查询、Word 报告、Excel 名单导出、图表可视化、政策总结与条款检索等多项功能。实际代码只实现了其中一部分基础数据分析能力：读取指定 Excel、按固定列提取渠道指标、计算损失及若干欠缺指标、按县和网格汇总，并在命令行打印结果。从主用途看，代码与声明中的“评优激励通报数据分析”部分是相关的，属于其支撑分析模块；但声明中另一大块“政策文档分析/检索”完全未出现，而且多个核心输出能力（Word 报告、Excel 预警名单、图表可视化、交互模式）也未在该代码块中体现。因此该描述对当前代码块来说明显过宽，存在实质性描述—行为不一致。另一方面，代码没有发现超出声明范围的可疑未声明能力；问题主要是声明覆盖了大量该代码并未实现的功能。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

从代码内容看，doc_qa.py 的核心职责非常明确：基于 policy_docs.json 和 term_map.json 做政策文档列表展示、文档摘要、规则条款提取、关键词检索与问答；此外通过 link_data() 在命中“门槛、激励、星级、APP、合约、投诉、牵引”等词时，从 analyzer.py 读取已分析数据并拼接少量实测摘要。这与声明中的“模式⑥政策文档分析、⑦政策文档检索问答”基本一致。但声明把技能整体描述为同时具备完整的 Excel 数据分析、欠缺诊断、薄弱环节识别、Word 报告生成、整改清单、预警分级名单导出、图表可视化等广泛能力，而本代码块并未实现这些能力，甚至命令入口只有 docs/summary/ask 三类，明显对应文档功能而非八种模式中的大多数。因此，就‘声明是否准确代表该代码块实际行为’而言，存在实质性不匹配：声明范围显著大于当前代码实际功能。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and instructs file-writing behavior and use of environment-provided paths, but does not declare an explicit tool scope or allowed-tools boundary. In an agent setting, that creates ambient-authority risk: the agent may read environment state and write files without a least-privilege contract, making unintended file creation or access-control bypass more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Very broad trigger phrases can cause the skill to activate on ordinary conversation and then access files, environment variables, or output-generation paths unexpectedly. In a skill that can analyze local documents and write reports, accidental invocation increases the chance of unintended data processing or unauthorized file operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Mode 0 is triggered by generic commands without strong disambiguation, which can route users into a workflow that proposes using default environment files or generating outputs they did not intend. Because the skill handles local Excel/Word content and file generation, overbroad invocation materially raises the risk of unintended access and processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This Python file contains natural-language descriptions and runtime messages entirely in Chinese, presenting the skill as fixed to a specific language. The policy for this audit flags language or locale constraints when they are imposed without user opt-in or an explicit documented justification.

Content

No source excerpt is available for this finding.

Tainted flow: 'OUT' from os.environ.get (line 18, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/doc_index.py (reported line 112)May include surrounding context.

python

}
        out.append(entry)
        print('OK', d['short'], '| 段落', len(items), '| 表格', len(tables), '| 章节', ' / '.join(sections))
    with open(OUT, 'w', encoding='utf-8') as f:
        json.dump(out, f, ensure_ascii=False, indent=1)
    print('索引已保存:', OUT)

Tainted flow: 'path' from os.environ.get (line 80, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/doc_index.py (reported line 158)May include surrounding context.

python

}

def save_term_map(path):
    with open(path, 'w', encoding='utf-8') as f:
        json.dump(TERM_MAP, f, ensure_ascii=False, indent=1)
    print('术语映射已保存:', path)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language instructions and outputs entirely in Chinese, including the module docstring and command help text. Under the policy rule for language/locale, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML explicitly sets lang="zh-CN" and all visible dashboard text is fixed in Chinese. Under SQP-3, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Tainted flow: 'OUT_HTML' from os.environ.get (line 61, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The script derives the output HTML path from the YJ_CHART_OUT environment variable and passes it directly to open() for writing, with no validation or restriction to a safe output directory. If an attacker can influence the environment in which the skill runs, they can cause arbitrary file overwrite within the process's filesystem permissions, which is especially relevant because this skill is designed to generate files automatically.

Content

Scanner excerpt · scripts/gen_charts.py (reported line 261)May include surrounding context.

python

'<div style="color:#888;font-size:13px;margin-bottom:20px">数据来源：2026年3季度合作伙伴评优激励通报20260811 · 渠道完成情况通报表</div>'
            f'<div style="display:flex;gap:10px;flex-wrap:wrap;margin-bottom:28px">{card_html}</div>'
            f'{imgs}</div></body></html>')
    with open(OUT_HTML, 'w', encoding='utf-8') as f:
        f.write(html)
    return OUT_HTML

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script fixes the document font to 微软雅黑 and all generated content is authored in Chinese, including the output filename and document headings. This enforces a specific language/locale behavior with no user opt-in or documented justification visible in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language content throughout the file is fixed in Chinese, and the document styling also forces a Chinese font, indicating the skill is locked to a specific locale. There is no visible opt-in, configuration, or documentation justifying the language restriction as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script saves a channel-level warning/ranking workbook to a fixed local path without any runtime confirmation, destination validation, or data-sensitivity check. In this skill context, the exported file contains operational performance, penalties, and remediation targeting data for partners/channels, so silent persistence to disk can expose sensitive business information to other local users, backups, sync agents, or unintended recipients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring, usage examples, and all user-facing output strings are written exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs the skill to produce output in a specific language/register such as「语言简洁通俗、避免术语」and elsewhere consistently assumes Chinese output, but it does not mention any user opt-in or alternative language handling. This can violate language/locale choice policy when users may expect responses in another language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames policy-document support as summarization and retrieval over user-supplied Word documents. L020 adds an implementation behavior of generating persistent local artifacts via doc_index.py, which goes beyond the user-facing description of analysis/retrieval and introduces local index creation as an undeclared behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L022 states the skill contains no built-in local paths and that all file paths come only from environment variables or user-provided paths. However, the same document later describes default document-location behavior around YJ_DOC_DIR for policy files, which weakens that absolute claim and creates a documentation/behavior mismatch about how file locations are sourced.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Allowing the skill to silently fall back to a 'latest batch' file from environment state broadens data access beyond the user's current upload or explicit reference. In a document-analysis context, that can cause unauthorized processing of stale or unrelated local data, which is a confidentiality and consent problem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction「语言简洁通俗」sets a mandatory output style and, in context, contributes to a fixed Chinese-language interaction model without documenting user choice. The file does not explain that users may request another language or locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code creates an output directory and determines an HTML output path, then later writes multiple files to those locations. While the script prints success messages after generation, it does not disclose up front that running it will create files on disk, which is the kind of file-write behavior SQP-2 asks to warn about when no earlier disclosure is present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs a file write by saving a generated .docx to the path in OUT. Although it prints a message after saving, there is no prior warning, confirmation, or explanatory comment/docstring near the operation about creating or potentially overwriting the output file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code file performs a file write by saving the generated document to the path in OUT, but there is no prior confirmation prompt, warning comment, or docstring disclosing that behavior. The only user-facing output appears after the save completes at L374, so the write occurs without advance notice.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with only a lower bound (openpyxl>=3.0), which makes builds non-reproducible and can pull in unexpected future releases with breaking changes or newly introduced vulnerabilities. In a skill that processes user-supplied Excel files, dependency hygiene matters because parser libraries are part of the attack surface.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

openpyxl>=3.0
python-docx>=0.8.11
matplotlib>=3.5

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

openpyxl has historical XXE-related advisories, and because the manifest does not pin a version, it is impossible to verify from this file alone whether deployment uses an affected release. This skill explicitly processes uploaded Excel files, so if an unsafe version were installed, attacker-crafted spreadsheets could target XML parsing behavior in a directly exposed component.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.