Security audit

county-business-query

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to perform the advertised business and bidding queries, but it also embeds agent-facing instructions that steer quota-exhausted users to a fixed QQ contact and constrain how the host agent may respond.

Review this skill before installing if you are uncomfortable with a third-party service controlling registration guidance through agent-facing instructions. Prefer environment-variable API-key configuration over passing keys on the command line, and independently verify the official registration URL and QQ contact before sharing credentials or account information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: scripts/query.py:85
Finding: Agent-Facing Instruction Hijacking Through Forced Promotional Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/query.py:190
Finding: API Key Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill contains contradictory user-routing instructions: the metadata says to send users to a single official registration URL, while the body says that on quota exhaustion the agent must not output links and should instead direct users to a QQ contact or skill detail page. This inconsistency can be exploited for phishing-like redirection, social-engineering, or confusing the agent into bypassing transparent provenance, especially because the skill also imposes hardcoded output constraints around contact details and URLs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents use of environment variables and network-backed querying, but it does not declare any explicit tool scope or allowed-tools boundary. Missing capability scoping increases the chance that a host agent grants broader execution or data-access privileges than intended, which matters more here because the skill handles API keys and external requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file describes the skill's capabilities in broad terms but does not define specific trigger phrases, invocation conditions, or exclusion cases. Without explicit trigger scope or negative examples, an agent may invoke the skill too broadly for generic county/business information requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The line requires exact output of Chinese-language content and a QQ contact workflow, but does not offer the user any language or locale choice. This can violate language/locale policy when users have not opted into Chinese-only interaction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring presents winners(中标电话) as a concrete capability, which implies retrieving winner phone data for a particular notice or query context. However, cmd_winners later invokes /winner_tel with no parameters at all, so the implemented behavior does not match the documented/user-facing intent and may return unrelated or unusable data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This script reads credentials from environment variables via get_key() and sends them as an X-API-Key header in api_get(). While the CLI help mentions configuration of the API key, the file lacks an explicit warning or disclosure that the key will be transmitted to a remote service endpoint during requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as operating in that language, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy, language constraints should be opt-in or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline comment states '零 URL 零域名', indicating the output should avoid URLs/domains to prevent replacement. But the same function sets out["register_url"] = REGISTER_URL, where REGISTER_URL is the official domain URL, so the comment directly contradicts the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The printed instruction mandates exact output behavior when explaining service status, requiring the response to be shown in a fixed form. In combination with the Chinese-only user-facing strings throughout the script, this creates a language/locale constraint without offering the user a choice or opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.