ClawHub
Back to skill

Security audit

Shopee-店铺价格分布 | 青虎AI

Security checks for vulnerabilities and agentic risk

Overview

This Shopee price-data skill is related to its stated purpose, but it tells the agent to install and update runtime tools and store/use account credentials in ways users should review first.

Review this before installing if you do not want an agent to install Node/npm packages, run unpinned qhkit versions, or change qhkit account configuration. Prefer a preinstalled, pinned qhkit version and confirm the correct site/account before giving an API token or approving paid calls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L003 说明“当用户说「这家店主要卖什么价位」「竞店定价」或提出同类需求时必须触发”。其中“竞店定价”和“同类需求”范围较宽，缺少明确约束、排除条件或负例，容易与一般性的竞品分析、定价讨论重叠，造成技能被意外调用。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill greatly expands scope by directing the agent to install Node.js and npm packages, including global installs and fallback execution paths, even though the business purpose is only querying Shopee price-band data. This turns a read/query skill into one that can modify the host environment and execute unreviewed third-party code, increasing supply-chain and host-compromise risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs use of npx @iqinghu/qhkit without pinning a specific version, which allows whatever the registry serves as the current package to be executed at runtime. In a skill context, this creates a supply-chain risk because the agent may fetch and run newly published code outside the reviewed skill content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This is a duplicate instance of the same persistence behavior: the skill directs installation into a user-controlled directory and environment changes that can survive the session. In the context of a data-query skill, adding persistence is unnecessary and materially increases the risk of unintended long-term code execution capability on the host.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Linux 二进制安装（装到用户目录，无需 root；先校验官方 SHA256 再解包）：

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

This is a duplicate instance of the same persistence behavior: the skill directs installation into a user-controlled directory and environment changes that can survive the session. In the context of a data-query skill, adding persistence is unnecessary and materially increases the risk of unintended long-term code execution capability on the host.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Linux 二进制安装(装到用户目录,无需 root;先校验官方 SHA256 再解包):

cd /tmp && curl -fsSLO https://nodejs.org/dist/v22.22.3/node-v22.22.3-linux-x64.tar.xz cd /tmp && curl -fsSL https://nodejs.org/dist/v22.22.3/SHASUMS256.txt | grep ' node-v22.22.3-linux-x64.tar.xz$' | sha256sum -c - mkdir -p "$HOME/.local/lib" && tar -xJf /tmp/node-v22.22.3-linux-x64.tar.xz -C "$HOME/.local/lib" export PATH="$HOME/.local/lib/node-v22.22.3-linux-x64/bin:$PATH"

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L100 明确要求“config show 返回的 site 必须是 cn”，并指示除非用户明确说明使用国际版账号，否则应覆盖为国内站配置。这属于对区域/站点的强制约束，未向用户提供显式选择或默认前征询，可能构成 locale 政策违规。

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

L015-L018 仅列出两个短语作为触发示例，没有说明必须满足的上下文条件，也没有列出不应触发的相邻场景。对于用户仅讨论竞店策略、价格定位或泛化电商分析时，是否应调用本技能并不明确。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.