Security audit

电商多平台商品数据分析助手

Security checks for vulnerabilities and agentic risk

Overview

The skill’s shopping-analysis purpose is coherent, but its generated HTML reports can execute unsafe content from product data.

Review or fix the report generator before installing: escape all product-derived text, restrict links to http/https, add rel="noopener noreferrer", and prefer bundling Chart.js locally or using integrity checks. Also consider unique per-run output paths or cleanup for /tmp files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:132
Finding: Stored HTML and JavaScript Injection in Generated Reports
Content: View full analysis
{icon} {platform}' ``` ```python return f'''

{platform_badge(plat)} {f'🏆 最推荐' if is_highlight else ''}

{p.get("title", "未知商品")}
{price_html}
{stars}

📝 {fmt_count(reviews)} 评价 🏪 {shop}
{f'
📌 {note}
' if note else ''} {f'🔗 查看商品' if url else ''}
''' ``` ```python watch_items = "" for w in advice.get("watch_out", []): watch_items += f"
{w}
" advice_html = f'''

💡 购买建议

{advice.get("buy_recommendation", "")}
{advice.get("reason", "")}

{f'
⚠️ 注意事项：
{watch_items}
' if watch_items else ''} {f'
📈 {advice.get("price_trend_note", "")}
' if advice.get("price_trend_note") else ''}
''' ``` ```python
🎯 {src.get("title", "未知商品")}
``` # ...[truncated 2681 chars]
Remediation: View remediation
``` 6. Prefer a template engine with automatic escaping, such as Jinja2 with autoescape enabled, rather than assembling HTML through f-strings. 7. Add a restrictive Content Security Policy. Avoid enabling inline scripts if the report can be restructured to load only trusted local resources. 8. Add regression tests using payloads containing `

T08 · Insecure Dependencies

Note

Location: scripts/generate_report.py:183
Finding: Generated Reports Execute an Unverified Third-Party CDN Script
Content: View full analysis
``` ### Technical Analysis Every generated report loads and executes Chart.js from the jsDelivr content delivery network when the report is opened. Although the dependency version is pinned to `4.4.0`, the script element does not specify a Subresource Integrity hash. The browser therefore has no cryptographic mechanism to verify that the downloaded resource matches the specific artifact reviewed by the project author. Report availability and behavior also depend on an external service at viewing time. This finding does not establish that Chart.js or jsDelivr is currently malicious. The risk arises from trusting executable third-party content without integrity verification and from introducing an external request that is not required for a self-contained report. ### Attack Path 1. The report generator creates an HTML report containing the external script reference. 2. A user opens the report while connected to the network. 3. The browser requests the Chart.js file from jsDelivr. 4. If the hosted artifact, CDN account, CDN infrastructure, DNS resolution, or delivery path is compromised, an altered script may be returned. 5. Because no integrity hash is present, the browser executes the altered JavaScript in the report context. ### Impact Assessment A compromised dependency response could execute arbitrary JavaScript with the same browser-level capabilities as the report. This could modify report content, redirect the user, inspect rendered report data, or make external network requests. Opening a report also discloses metadata to the external CDN, including the user's IP address, request time, and browser request headers. The issue does not by itself provide operatin ...[truncated 95 chars]
Remediation: View remediation
``` The hash must be calculated from and compared against the exact reviewed release artifact; a placeholder must not be deployed. 3. Configure a restrictive Content Security Policy that permits scripts only from the intended local source or explicitly approved CDN. 4. Document the external request and its privacy implications. 5. Establish a dependency-review process covering version updates, integrity hashes, release provenance, and known vulnerability monitoring. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents the skill as an end-to-end e-commerce analysis assistant that takes product links from multiple platforms and automatically gathers and compares data across sites. However, the supplied code is solely a report generator. It reads structured JSON from disk, formats prices/counts/ratings, and emits a styled HTML report with Chart.js visualizations. There are no network requests, browser automation, scraping logic, platform-specific parsers, search/matching logic, or link-processing functionality. Generating an HTML report is consistent with one part of the description, but the primary upstream capabilities described—accepting arbitrary product links, collecting the data, and performing cross-platform discovery—are absent from this code chunk. Therefore, the code materially underimplements the declared purpose and the description does not accurately represent what this chunk actually does.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include broad everyday expressions like '帮我看看这个商品' and '这个值不值', which can cause the skill to activate in contexts the user did not clearly intend. Because the skill is allowed to use WebFetch, WebSearch, Bash, and Write, overbroad triggering can lead to unintended network access and local file creation from ambiguous requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill writes JSON and HTML files to /tmp and invokes a local script, but the user is not explicitly told that local files will be created or overwritten. Hidden filesystem side effects reduce user control and can expose sensitive scraped data to other local processes or create confusion about artifact persistence.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level description and generated output are entirely hard-coded in Chinese, indicating the skill is designed to operate in a single language without user opt-in. Under the policy, language constraints should either offer user choice or be explicitly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 描述文本整体以中文限定技能行为和触发方式，未说明是否支持其他语言，也未给出用户选择语言/区域设置的选项。根据组织语言/locale 政策，若技能默认强制单一语言而无用户选择，可能构成自然语言策略问题。
Content: No source excerpt is available for this finding.