Security audit

county-business-query

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its business-query purpose, but its registration guidance inconsistently redirects users from the stated official website to an off-platform QQ contact for API-key onboarding.

Review this skill before installing if you are uncomfortable with API-key registration or payment instructions being routed through an off-platform QQ contact. Prefer using the clearly stated official website from the skill details, avoid short links, and do not share unrelated credentials or personal information with the script or support contact.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s documented purpose and its operational instructions diverge in security-relevant ways: registration flow guidance changes from a fixed official URL to an off-platform QQ contact, and the winners function appears to expose a global phone directory rather than data scoped to a specific announcement. These inconsistencies can mislead users, bypass expected trust controls, and enable broader-than-expected disclosure of business contact data.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares executable behavior that uses environment variables and network access, but it does not explicitly scope or restrict those capabilities via permissions or allowed-tools metadata. That creates an overprivileged integration surface where the host may grant broader access than users expect, increasing the risk of secret exposure or unintended outbound requests if the implementation changes or is abused.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The FAQ instructs the agent to suppress the previously stated official URL and instead direct users to a QQ contact, which is a contradictory and security-significant redirection. This increases phishing and social-engineering risk because users are trained to trust an alternate contact channel that is harder to verify than the declared official registration endpoint.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The instructions require the model to output a specific Chinese support message and exact QQ number formatting, which effectively constrains user-facing language behavior. Because no language choice or opt-in is offered, this is a natural-language policy concern under the locale/language rule.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The code’s runtime message overrides the manifest’s stated official registration path and instructs users to obtain the address through QQ or the skill detail page instead. That creates an inconsistent trust path for credential enrollment, increasing phishing and social-engineering risk because users may be trained to ignore the documented official URL and rely on out-of-band instructions to obtain an API key.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as serving Chinese county-level bidding and business data, but it does not explicitly state that the skill is China-specific or that Chinese is required. This can create a language/locale policy issue because users are not offered a language choice or clear opt-in to a locale-specific experience.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The inline comment at L088 states '零 URL 零域名', implying no URL/domain should be emitted. However, the code sets out['register_url'] = REGISTER_URL at L087, which directly includes a URL/domain in the returned data, contradicting the stated intent in the comment.

Static analysis

No suspicious patterns detected.