Security audit

Ecommerce Return Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This is a local ecommerce returns analysis skill with no network or persistence, though it includes unused generic audit code that users should not rely on or enable casually.

Install only if you want a Chinese-language local returns-analysis helper. Provide it only the returns CSV/TSV or text you intend to analyze, prefer dry-run/stdout for sensitive data, and avoid modifying the bundled spec to enable the dormant directory or security-audit modes unless those are separately reviewed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is return-reason analysis, but the detected behavior suggests broader directory scanning, package inspection, risk-pattern scanning, and generalized report generation. This mismatch is dangerous because it can mislead users and orchestrators into granting access under a benign business-analytics label while the skill performs broader local analysis than necessary.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script's implemented behavior is a generic local audit/report generator with directory scanning, CSV inspection, pattern matching, and skill-package auditing, which materially diverges from the declared ecommerce return-intelligence purpose. This kind of scope mismatch is dangerous because it can be used to induce users or orchestrators to run unintended local file inspection workflows, exposing repository contents, metadata, or sensitive text under a misleading skill identity.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrases are broad, natural-language requests such as '分析这批退货原因' and '区分产品问题和预期错配', which can overlap with ordinary conversation and cause the skill to activate when a user did not explicitly intend to invoke it. This is not a code-execution issue, but it can lead to unintended processing of local business data or accidental workflow routing, especially in environments that auto-select skills from conversational text.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares executable capabilities via `python3` and implies file input/output behavior, but does not explicitly declare a tool scope such as allowed tools or permissions. This creates an authorization ambiguity where a host agent may permit broader shell or filesystem access than users expect, increasing the chance of unintended command execution or file writes.

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The entire sample input is written in Chinese and the instructions implicitly require Chinese-language headings and output conventions, but there is no indication that language choice is optional or user-selected. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This manifest uses Chinese for the title, labels, summary, examples, and risk note, but it does not state that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The template is entirely written in Chinese and implicitly steers outputs into Chinese without any mechanism to respect the user's language preference or explicit opt-in. In a multilingual or English-default environment, this can cause policy noncompliance, user confusion, and downstream workflow errors when other systems or reviewers expect a different language.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The generated report strings in make_structured_report are fixed in Chinese, which forces a specific language for user-facing output. The policy for this audit flags language/locale constraints when they are imposed without offering a user choice or documenting a justified region-specific scope.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The pattern_audit mode scans arbitrary files or directories for security-related regex matches such as secrets and internal URLs, which is unrelated to ecommerce returns analysis. Even without code execution, this creates an unintended capability to inspect local content and surface sensitive snippets, expanding data-access beyond the stated trust boundary of the skill.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill_audit/frontmatter auditing logic inspects package structure and metadata for arbitrary skill directories, which is unrelated to return-reason analysis and indicates hidden generalized auditing behavior. In the skill context, this mismatch is more dangerous because users expecting business analysis may unknowingly grant access to local project contents and internal documentation.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The CLI description presents the program as a support script for this skill, while the actual modes implement generic audits unrelated to the manifested intent. Mislabeling capabilities is a security issue because it undermines informed consent and can cause operators or automated systems to execute broader local analysis than they intended.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: This markdown file presents all testing instructions and expected outcomes only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification can be a locale policy issue.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The manifest description is primarily in Chinese and the document body is also Chinese, which can amount to a locale/language constraint for users. While not explicitly prohibiting other languages, it does not offer any language choice or opt-in, so it may conflict with a policy requiring language flexibility.

Static analysis

No suspicious patterns detected.