alphashop-text

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:30 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed AlphaShop API wrapper for translation and product copy, but users should avoid sending sensitive text and should protect the API keys.

Install this only if you intend to send translation or product-copy text to AlphaShop's remote API. Use dedicated API keys, keep them out of source control, avoid submitting secrets, customer data, or sensitive business text unless authorized, and prefer pinned dependency versions for reproducible installs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The README presents all user-facing instructions in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can constitute a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requires environment secrets and makes outbound API calls, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. That creates a capability/expectation mismatch: an agent may invoke a networked script with access to sensitive environment variables without clear policy boundaries or operator review. In this context, the skill is official and its purpose legitimately needs network and env access, which lowers suspicion of maliciousness but does not remove the security risk from undeclared capabilities.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases are broad generic terms like translation, title generation, and selling-point generation, without constraints on when this skill should or should not be selected. That can cause over-triggering, leading the agent to route unrelated user text to an external API and potentially disclose sensitive or unnecessary content to a third party. Because the skill's stated function is text processing, the context makes accidental data exposure more plausible than direct exploitation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation directs users to send free-form product text and descriptions to a remote API service but does not warn that this content may contain sensitive business, customer, or proprietary information. That omission can lead users to transmit confidential data without informed consent or data-handling review, creating privacy, compliance, and data exposure risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code sends CLI-supplied text, product names, descriptions, and related content to https://api.alphashop.cn via HTTP POST. While the module docstring identifies the API, it does not clearly warn users that their supplied content will be transmitted to an external service, which is relevant for privacy and data-handling awareness.

External Transmission

Medium

• Category: Data Exfiltration

Content

url = f"{BASE_URL}{path}"
    headers = {"Content-Type": "application/json", "Authorization": f"Bearer {get_token()}"}
    try:
        r = requests.post(url, json=body, headers=headers, timeout=120)
        r.raise_for_status()
        return r.json()
    except requests.exceptions.HTTPError as e:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file includes setup instructions for `ALPHASHOP_ACCESS_KEY` and `ALPHASHOP_SECRET_KEY`, which are sensitive credentials. The section explains how to place them in config but provides no warning about keeping them secret, avoiding committing them to source control, or handling them securely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0
PyJWT>=2.0.0

• Confidence: 97% confidence
• Finding: The dependency specification uses a lower-bound only constraint (`requests>=2.20.0`), which makes builds non-reproducible and allows installation of unexpectedly vulnerable or breaking versions over time. In a security-sensitive skill that likely performs outbound HTTP requests to an external API, leaving `requests` unpinned increases supply-chain risk and makes it impossible to verify whether deployed environments are using a patched release.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: `requests` has multiple known advisories, and because the manifest does not pin a specific version, there is no way to determine whether the deployed package is affected. For a text-processing/API integration skill, `requests` is likely central to external communications, so using an unknown release can expose the skill to issues such as credential leakage, TLS/verification problems, or other client-side HTTP weaknesses depending on the installed version.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.20.0
PyJWT>=2.0.0

• Confidence: 97% confidence
• Finding: The dependency specification for `PyJWT` is also unpinned (`PyJWT>=2.0.0`), so the resolved package version may vary across installs and could include vulnerable or incompatible releases. Because this skill appears to interact with an API and may rely on JWT handling for authentication, an uncontrolled version introduces avoidable supply-chain and authentication-related risk.

Unverifiable Dependency: PyJWT has 16 known advisory(ies) (CVE-2026-32597 (PyJWT accepts unknown `crit` header extensions); CVE-2024-53861 (PyJWT Issuer field partial matches allowed); CVE-2026-48522 (PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: `PyJWT` has known advisories, but the manifest leaves the installed version unverifiable by not pinning it. In a skill that may use JWTs for API authentication, this can become more dangerous because flaws in token validation, issuer matching, header handling, or JWK retrieval could affect authentication integrity if an impacted version is installed.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Natural-language strings for commands and argument help force Chinese-language interaction cues in multiple places, such as command descriptions and option help text. The file does not offer an alternative language or explain that the tool is intentionally limited to a Chinese-speaking context.

Static analysis

No suspicious patterns detected.