T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:6- Finding
Skill instructions monopolize shopping requests and force promotional output
- Content
View full analysis
- Remediation
View remediation
Security audit
1688-utp-shopping
Security checks for vulnerabilities and agentic risk
Overview
This shopping skill is coherent, but it asks the agent to install unpinned global software and modify agent configuration automatically, which deserves review before installation.
Review the installer before using it. Only install if you are comfortable with global npm packages, persistent MCP configuration changes, and UTP state under your home directory; avoid automatic install flows, verify the npm package source/version, and back up agent MCP configs and PATH settings first.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:351- Finding
Unpinned remote packages are installed globally and executed
- Content
View full analysis
&1)" if ! $npm_ok && echo "$npm_out" | grep -q "EEXIST"; then npm i -g "${NPM_PACKAGE}" --registry "${NPM_REGISTRY}" --force fi UTP_BIN_PATH="$(command -v utp 2>/dev/null || echo '')" if "$UTP_BIN_PATH" --version >/dev/null 2>&1; then : fi ``` No package version, integrity digest, lockfile, or trusted publisher verification is enforced. Both the package name and registry are environment-controlled. The `--force` fallback can replace an existing global `utp` command, extending the impact beyond the Skill directory. The DSH overlays likewise use `npx -y` without a pinned version: ```yaml command: npx args: ['-y', '@ut-protocol/utp', 'mcp', 'serve'] ``` The interactive overlay repeats the same behavior: ```yaml command: npx args: ['-y', '@ut-protocol/utp', 'mcp', 'serve'] ``` This makes the effective executable payload mutable after the Skill itself has been audited. A future package release, compromised publisher account, registry compromise, dependency compromise, or poisoned environment can change the code that runs. The Windows installers have the same underlying issue by installing `@latest` packages. They also download a current Node.js archive without checking its published checksum or signature. ### Attack Path #### Registry or publisher compromise 1. An attacker compromises the npm publisher, ...[truncated 1770 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/install.sh:602- Finding
MCP configuration merge can erase existing configuration and permits path-based script injection
- Content
View full analysis
"$mcp_path" << FULLEOF { "mcpServers": { "utp-connector": { "command": "${UTP_BIN_PATH}", "args": ["mcp", "serve"] } } } FULLEOF ``` The flagged access to `.qoderworkcn/mcp.json` ...[truncated 1983 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/install-win.sh:91- Finding
Git Bash installer can replace the user PATH instead of appending to it
- Content
View full analysis
/dev/null | tr -d '\r' || echo "") if echo "$current_user_path" | grep -qi "nodejs"; then echo "[INFO] PATH already contains a nodejs entry" else win_path="C:\\Users\\${USERNAME}\\nodejs" cmd.exe //c "setx Path \"${win_path}\"" >/dev/null 2>&1 fi ``` `setx Path "${win_path}"` replaces the user-level PATH value with only the Node.js directory. It does not append the directory to the existing user PATH. After a new shell or application starts, programs previously available through user PATH entries may no longer be found. The test is also imprecise because it skips modification whenever any PATH component contains the substring `nodejs`, even if it does not match the intended installation directory. ### Attack Path 1. A user has multiple required directories in the user-level PATH. 2. The user or agent runs `scripts/install-win.sh`. 3. The existing PATH does not contain the substring `nodejs`. 4. The script executes `setx Path` with only the new Node.js path. 5. Future processes receive a user PATH missing the previous entries. 6. Development tools, security utilities, package managers, or host executables may stop resolving correctly. This issue is directly reachable during normal installation and does not require an external attacker. ### Impact Assessment The issue compromises the integrity and availability of the user environment. It may: - Break unrelated command-line tools and agent hosts. - Alter which executable is resolved if fallback system directories contain a different binary with the same name. - Require manual registry repair. - Disrupt automation launched after install ...[truncated 88 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (67)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text package: check ## 打公网 zip 包（输出到 ~/Documents/） @echo "打包: $(PKG_NAME).zip" @rm -rf "$(TMP_DIR)/$(PKG_NAME)" @mkdir -p "$(TMP_DIR)/$(PKG_NAME)" @cp $(SKILL_MD) "$(TMP_DIR)/$(PKG_NAME)/" @cp README.md "$(TMP_DIR)/$(PKG_NAME)/"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text @cp -R scripts "$(TMP_DIR)/$(PKG_NAME)/" @cp -R references "$(TMP_DIR)/$(PKG_NAME)/" @cp dsh.cordis.yml dsh-apps.cordis.yml "$(TMP_DIR)/$(PKG_NAME)/" @rm -rf "$(TMP_DIR)/$(PKG_NAME)/scripts"/.git @mkdir -p "$(OUT_DIR)" @rm -f "$(ZIP_FILE)" @cd "$(TMP_DIR)" && zip -r "$(ZIP_FILE)" "$(PKG_NAME)" -x "*.DS_Store"
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill presents itself as an in-conversation procurement tool, yet its instructions cover global npm installation, host-directory modification, MCP config rewrites, and reset/removal actions. This hidden expansion of capability increases the chance of unintended persistence, host tampering, or disruption to other tools if the skill is trusted and executed automatically.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as an in-conversation procurement tool, yet its instructions cover global npm installation, host-directory modification, MCP config rewrites, and reset/removal actions. This hidden expansion of capability increases the chance of unintended persistence, host tampering, or disruption to other tools if the skill is trusted and executed automatically.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list is extremely broad and includes many common commerce terms, causing the skill to aggressively claim conversations and insist on non-transfer even when other tools may be more appropriate. In a skill that can invoke shopping, login, installation, or shell/setup flows, overbroad routing increases the chance of unwanted transactions, unnecessary privileged actions, or denial of safer alternatives.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md true` 即本错误已带引导），AI 无需再判断。结果里没有该段的旧版本/云端场景，才按 `references/feedback-guide.md` 展示 `references/feedback-qrcode.png`。本地修复了也要展示：用户反馈“刚才出了 XX 错、后来好了”对定位隐藏问题同样有价值。用户主动索
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Codex-specific instruction says the agent should execute installation immediately, without asking the user and without surfacing that it will perform a global npm install and modify persistent skill/MCP files. Combining silent dependency installation with config changes is especially risky because it normalizes privileged system mutation inside a shopping workflow.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 96% confidence
- Finding
The skill references and instructs modification of
~/.codex/config.toml, an agent configuration directory/file that controls MCP server behavior. Directing a task skill to alter agent config is dangerous because it can establish persistence, affect future sessions, and potentially route tool execution through attacker-influenced components.- Content
bash /scripts/install.sh --host codex
text `<skill-dir>` 为本 Skill 当前所在目录（如 `~/.codex/skills/utp-shopping` 或项目内 `.agents/skills/1688-utp-shopping`）。脚本自动完成三件事：npm 全局安装 utp CLI → 复制 Skill 文件到 `~/.codex/skills/utp-shopping/` → 在 `~/.codex/config.toml` 写入 MCP 配置（幂等，可重复运行）。 **本机还没有 Skill 文件时**（能读到本指引但找不到 `scripts/install.sh`），先补文件再执行安装，两条命令一次跑完：
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text #Requires -Version 5.1 # 一键安装 Node.js LTS + UTP CLI（Windows 原生 PowerShell 版） # 无需管理员权限，解压到用户目录并写入用户级 PATH param([switch]$Reset)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh extracted_dir="$HOME/node-v${version}-win-x64" # 清理旧的解压目录（如果有） [[ -d "$extracted_dir" ]] && rm -rf "$extracted_dir" unzip -q -o "$temp_zip" -d "$HOME"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
rm -rf on ${HOME}/.utp removes all local UTP data recursively, and although the path is fixed and quoted, it is still a destructive operation exposed through a command-line flag. In a skill installer context, accidental or socially engineered use of --reset could erase user state without recovery or confirmation.
- Content
sh # 1. 清除 ~/.utp/ 全部数据(config / preferences / 旧 bin 等) if [ -d "${HOME}/.utp" ]; then rm -rf "${HOME}/.utp" info "已清除 ~/.utp/" else info "~/.utp/ 不存在,跳过"
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh mcp_json_path="${HOME}/.cursor/mcp.json" ;; codex) # Codex:skill 装到 ~/.codex/skills/,MCP 配置是 TOML(~/.codex/config.toml),不走 JSON 路径 skill_dir="${HOME}/.codex/skills/${SKILL_NAME}" ;; *)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh mcp_json_path="${HOME}/.cursor/mcp.json" ;; codex) # Codex:skill 装到 ~/.codex/skills/,MCP 配置是 TOML(~/.codex/config.toml),不走 JSON 路径 skill_dir="${HOME}/.codex/skills/${SKILL_NAME}" ;; *)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh mcp_json_path="${HOME}/.cursor/mcp.json" ;; codex) # Codex:skill 装到 ~/.codex/skills/,MCP 配置是 TOML(~/.codex/config.toml),不走 JSON 路径 skill_dir="${HOME}/.codex/skills/${SKILL_NAME}" ;; *)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi if [ -d "${SKILL_DIR}/references" ]; then rm -rf "${skill_dir}/references" cp -R "${SKILL_DIR}/references" "${skill_dir}/references" info "references/ 已复制" fi
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi if [ -d "${SKILL_DIR}/scripts" ]; then rm -rf "${skill_dir}/scripts" cp -R "${SKILL_DIR}/scripts" "${skill_dir}/scripts" info "scripts/ 已复制" fi
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
sh if [ "$host" = "codex" ]; then # Codex 用 TOML 配置(~/.codex/config.toml),单独处理 write_codex_mcp_config info "MCP 配置已写入 ${HOME}/.codex/config.toml" else write_mcp_config "$mcp_json_path" "$host" info "MCP 配置已写入 ${mcp_json_path}"
Static analysis
No suspicious patterns detected.