1688-utp-shopping

• Outcome: Review
• Latest audit: Aug 24, 2026 · 10:10 AM UTC
• Version: 2.0.1

Overview

This is a real 1688 shopping skill, but it also grants broad installation, update, host-configuration, and local-deletion powers that users should review before installing.

Install only if you are comfortable with this skill changing your agent host configuration, installing or updating a global utp CLI, enabling an MCP connector, storing local shopping preferences, and potentially deleting local UTP state when reset options are used. Treat purchase, login, checkout, update, and reset prompts as sensitive actions that need explicit user review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence
• Finding: The skill advertises shopping behavior but the analyzer detected file-write and shell-capable behavior without declared permissions. In the context of an agent skill, undeclared ability to modify local files or execute commands expands the trust boundary and can enable silent installation, persistence, or host tampering beyond what a shopping assistant needs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This is a strong description-behavior mismatch: the skill claims to be an in-conversation shopping assistant, but associated behavior includes downloading software, globally installing packages, editing MCP configuration, copying files into host directories, and deleting local data. That mismatch is dangerous because users may authorize a commerce action while the skill performs system-level changes with persistence or destructive side effects.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The guide instructs the agent to perform self-update and connector disable/enable operations, which are administrative actions unrelated to a shopping assistant’s core purpose. Granting a commerce skill authority to alter local binaries and restart integrations expands its privilege boundary and creates a path for unintended system modification or supply-chain abuse if the update mechanism or prompting flow is compromised.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This section explicitly authorizes replacing the local executable and restarting the connector, capabilities far beyond what a shopping workflow requires. In the context of a purchasing skill, this mismatch is especially dangerous because it normalizes high-privilege host changes inside a user-facing transactional tool, increasing the blast radius of prompt injection, malicious updates, or operator error.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The reset branch deletes the entire ~/.utp directory recursively and forcefully, which can remove local UTP state and host-related configuration unrelated to the shopping skill’s core purpose. In the context of a commerce skill, bundling destructive local cleanup into an installer increases risk because a user may run it expecting setup, not irreversible data removal.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script persists changes to the user PATH in HKCU and later integrates the UTP CLI with a detected host, altering the user environment beyond the narrow needs of a shopping workflow. Persistent environment and host-configuration modification can have lasting side effects and expands the script’s operational scope, especially if users are not clearly informed.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation guidance is broad enough that common phrases like wanting to buy something could invoke a transactional shopping skill during ordinary discussion. In a skill that can search suppliers, manipulate carts, and progress toward checkout, overbroad triggering increases the risk of unintended tool use, accidental data disclosure to external commerce hosts, and user confusion about when real actions may begin.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Examples such as “看看这个”, “取消”, or “买这个” are highly context-dependent and do not define the conditions under which the skill should assume authority over a conversation. In a purchasing skill with real-world transactional capability, ambiguous invocation patterns can cause unintended searches, cart changes, or order-flow actions, especially when the surrounding agent routes based on natural language heuristics.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger list is extremely broad and includes common words such as 买, 商品, 供应商, 订单, 购物车, and even generic English commerce terms. Because this skill can drive real transactional and potentially installation flows, overbroad invocation increases the chance it activates in contexts where the user did not clearly intend to shop or authorize downstream actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The description emphasizes convenience and mandatory routing to this skill but does not clearly warn that it can initiate real order, checkout, payment, login, and user-data handling flows. In a commerce skill, missing up-front disclosure undermines informed consent and raises the risk of users triggering sensitive actions without understanding the consequences.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide documents direct cart mutation and checkout-completion commands without requiring explicit user confirmation, safety interlocks, or user-facing warnings before state-changing actions. In a shopping skill whose purpose is to search, add to cart, and place orders, this increases the risk of unintended purchases, quantity changes, or destructive cart operations triggered by ambiguous prompts or agent misinterpretation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The identity-binding flow opens a browser-based OAuth login and discusses automatic login prompts, but the guide omits privacy and consent guidance about what account is being linked, what data will be accessible, and when login should occur. In a transaction skill tied to purchasing, silent or poorly explained authentication prompts can mislead users into linking a personal buyer account without informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide explicitly instructs the agent to directly modify host MCP configuration files and connect a server without requiring clear user consent or a warning that local configuration will be changed. This creates a dangerous precedent where the skill can persistently alter the user's environment, potentially enabling unwanted tooling, persistence, or trust-boundary violations beyond the immediate shopping task.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installation guidance authorizes running scripts that may force-overwrite an existing global `utp` command and optionally reset local data and host skill/MCP state, without an upfront warning or confirmation gate. That combination can disrupt existing tooling, destroy local state, and make persistent system changes under the guise of setup, which is risky even if intended for convenience rather than harm.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide explicitly permits falling back to a local file (`~/.utp/preferences.json`) to store user preference/profile data when host memory tools are unavailable, but it does not require clear user notice, consent for local persistence, retention limits, or access controls. In a shopping skill that handles procurement preferences and potentially sensitive behavioral data, silent local storage increases privacy and data-handling risk, especially on shared or unmanaged hosts.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document describes silently downloading a new binary into the user's home directory in the background without clearly foregrounding that this writes executable content before the user approves installation. Even if not immediately executed, silent staging of binaries is security-sensitive behavior that can surprise users, weaken trust, and create a foothold for tampering if the download or storage path is not strongly protected.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide states that a manual `utp update` directly replaces the current binary but omits an explicit warning that this is a privileged, potentially disruptive operation. Without clear risk framing, an agent or user may trigger executable replacement too casually, leading to service interruption, unexpected code changes, or unsafe acceptance of unverified updates.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Reset mode permanently deletes ~/.utp with Remove-Item -Recurse -Force and performs no confirmation, dry-run, or backup. That makes accidental invocation destructive and can erase user data or local configuration with no recovery path.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script persistently overwrites the user's PATH with `setx Path "${win_path}"` and does so without confirmation or preserving existing PATH entries. On Windows, this can break other tooling, alter command resolution, and create a persistence mechanism for later-executed binaries in that directory. In the context of a shopping skill that insists on installation and continued use, silent environment modification is more concerning because it pressures users into broad system changes to enable transactional functionality.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script deletes an existing extracted directory and replaces the fixed install location, moving any prior `$HOME/nodejs` to a backup and removing `$HOME/node-v${version}-win-x64` recursively. Although paths are quoted, this still performs destructive filesystem changes without advance warning, which can cause data loss, clobber local customizations, or replace a previously trusted runtime with a newly downloaded one. In this skill context, forced installation behavior increases risk because the user is nudged to accept local system changes just to use the commerce workflow.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script performs a global npm install from a registry that can be overridden by environment variables and then executes the installed `utp.exe`. This creates a supply-chain and remote code execution risk: a malicious or compromised registry/package could deliver arbitrary code, which is then run locally. Given the skill metadata explicitly pushes users to install and not hand off even if MCP is missing, the surrounding context makes this more dangerous by normalizing execution of externally sourced code as a prerequisite for shopping actions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 1. 清除 ~/.utp/ 全部数据(config / preferences / 旧 bin 等)
  if [ -d "${HOME}/.utp" ]; then
    rm -rf "${HOME}/.utp"
    info "已清除 ~/.utp/"
  else
    info "~/.utp/ 不存在,跳过"

• Confidence: 91% confidence
• Finding: The script performs a recursive deletion of ~/.utp when --reset is used. Although the target path is constrained and quoted, this still deletes all local UTP state in one step and could cause destructive data loss if the script is run unexpectedly, with elevated privileges, or by a user who does not understand the consequences.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.