Security audit

负一屏购物

Security checks for vulnerabilities and agentic risk

Overview

This shopping skill is mostly aligned with its purpose, but it can place and schedule purchases using stored credentials and addresses with weak scoping and unclear notification handling.

Install only if you trust the publisher and are comfortable giving the skill purchase authority, a cloud auth code, and shipping address data. Before use, replace or remove bundled config values, protect the config file, verify the remote shopping service, avoid broad auto-trigger use, and do not schedule purchases unless you can review or cancel the task and accept that it may spend money later without you present.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The scheduled-purchase flow gives conflicting instructions about whether results are automatically shown in the current session or must be manually pushed with sessions_send to the original session. In security-sensitive purchase flows, this ambiguity can cause results, addresses, and order details to be delivered to the wrong session or duplicated across sessions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The cron creation section says the task runs in the current session while the payload also references sending results to the original session, and later sections describe a different execution and delivery behavior. These contradictions increase the chance of cross-session data leakage or unintended autonomous actions in the wrong conversational context.

Vague Triggers

High

Confidence: 95% confidence
Finding: The README states the skill auto-triggers whenever a user message contains the character “买”, which is far too broad for a purchasing capability. In a shopping skill, this creates a real risk of unintended activation from ordinary conversation, potentially leading to product searches, state changes, or even purchase flows without sufficiently explicit user intent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README documents unattended scheduled purchasing and automatic execution at a later time, but does not prominently warn users about the risks of autonomous financial transactions. In this skill context, that omission is especially dangerous because it normalizes deferred purchases using stored credentials or tokens, increasing the chance of accidental, unauthorized, or poorly understood spending.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to place authCode and secretToken directly in a local JSON config file without any warning about secret handling, storage permissions, or rotation. While documentation alone is not code execution, in this context it encourages insecure secret management for credentials tied to purchasing and payment, which could expose accounts or enable unauthorized transactions if the file is leaked.

Vague Triggers

High

Confidence: 95% confidence
Finding: Triggering on any dialogue containing the character "买" is overly broad for a skill that can search products, reveal saved address data, modify configuration, and initiate purchases. Everyday speech could unintentionally invoke the workflow, creating a real risk of unwanted shopping actions or sensitive data exposure.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The manifest trigger phrases are ambiguous and broad for a high-risk commerce skill, making accidental activation more likely. Because the workflow includes autonomous scheduling and payment execution, weak trigger scoping materially increases risk.

Missing User Warnings

High

Confidence: 92% confidence
Finding: The skill handles sensitive data including authCode, phone numbers, and full delivery addresses and transmits purchase-related data to cloud-side interfaces, but it provides no explicit warning, consent language, or data-handling constraints. Users and operators may not realize that highly sensitive personal and transactional data is being processed and sent externally.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow allows user-provided address text to be parsed and written back into seap.config.json, but it does not warn that persistent configuration will be modified. Silent persistence of sensitive personal data increases privacy and integrity risk and can lead to unintended reuse in later purchases.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill silently reads a sensitive auth code from environment/config and uses it for remote requests without explicit user disclosure or consent at runtime. In a purchasing context, hidden use of stored credentials can lead to unauthorized account actions or surprise data transmission, especially when the remote endpoint is external.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The search flow transmits the user's shopping intent together with an auth code to a remote server without visible notice in the code path. Even if HTTPS is used, undisclosed transmission of user intent and credentials creates privacy and trust risks, particularly for an agent skill where the user may not expect off-device processing.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The order-placement function performs a real purchase action against a remote server with no interactive confirmation, dry-run, or secondary approval step. In a shopping skill, this is especially dangerous because a mistaken or induced invocation can directly trigger financial loss and disclosure of shipping information.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The instructions direct the agent to display the full saved delivery address back into chat during confirmation. Exposing complete names, phone numbers, and detailed addresses in conversational transcripts unnecessarily increases the chance of privacy leakage through logs, screenshots, session sharing, or misdelivery.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The scheduled task payload and completion flow instruct the agent to push purchase results including address and order details into a session, which may not reliably be the original verified user context given the documented session ambiguity. This creates a meaningful risk of leaking personal and transactional information across sessions or into persistent logs.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/seap-cli.js:72