Security audit

xc-xiaov

Security checks for vulnerabilities and agentic risk

Overview

This Vipshop shopping skill is coherent, but it needs review because it can globally install a CLI and automatically start account login flows.

Install only if you trust the Vipshop CLI package and are comfortable with the assistant using your Vipshop login state. Confirm before any login, avoid sharing QR login links or local image paths in chat logs, and prefer a sandboxed or pre-vetted local CLI instead of automatic global installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: vipshop-product-detail/SKILL.md:24
Finding: Automatic Global Installation of an Unverified Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Locations**: - `vipshop-product-detail/SKILL.md:24-27` - `vipshop-product-search/SKILL.md:24-27` - `vipshop-promotion-search/SKILL.md:24-27` - `vipshop-user-login/SKILL.md:11-14` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code Snippet ```bash npm install -g vipshop-cli@1.0.4 ``` The product-detail skill mandates the installation as follows: ```markdown ### Step 1: Check component installation and login status Before executing a query, the AI must check dependencies: 1. Check whether `vipshop-cli` is installed. If it is absent, install it globally: `npm install -g vipshop-cli@1.0.4` 2. Execute `vipshop status` to check login status. ``` Equivalent mandatory global-installation instructions appear in the product-search, promotion-search, and user-login skills. ### Technical Analysis The skills direct the Agent to install `vipshop-cli@1.0.4` globally from the npm registry. The supplied project does not include the package implementation, a lockfile, a cryptographic integrity value, a verified source repository, or other evidence that would allow the installed artifact and its transitive dependencies to be audited. Pinning the version reduces accidental version drift but does not establish package integrity or publisher trust. An npm installation may execute package lifecycle scripts, such as `preinstall`, `install`, and `postinstall`, with the permissions of the user running the Agent. The global installation also places the `vipshop` executable in a shared command search path. The installed CLI subsequently receives or manages security-sensitive data, including: - Vipshop QR login tokens. - Saved authenticated session state. - `PASSPORT_ACCESS_TOKEN` cookies. - Vipshop account API requests. Consequently, compromise of the package, its publisher account, registry artifact, or transitive dependency could affect both the local host and the authenticated V ...[truncated 1798 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not allow a skill to install a global package automatically. Obtain explicit user or administrator approval before changing the runtime environment. 2. Prefer a project-local installation inside a restricted sandbox or disposable container. 3. Vendor the required implementation into the reviewed project or reference a verified official repository whose source can be independently audited. 4. Use a lockfile and verify the npm artifact with a trusted cryptographic integrity value. 5. Review all direct and transitive dependencies before deployment. 6. Disable npm lifecycle scripts when they are unnecessary: ```bash npm install --ignore-scripts ``` This must only be used after confirming that the package legitimately works without installation scripts. 7. Run the CLI under a dedicated, least-privileged operating-system account with restricted filesystem and network access. 8. Avoid adding the dependency to a shared global command path. Invoke an audited binary through an absolute path. 9. Separate authentication storage from the CLI process and restrict token-file permissions. 10. Pin the allowed outbound destinations to documented Vipshop endpoints and monitor unexpected network connections. 11. Include the actual CLI source in the audit scope before allowing the skill to handle real account credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: vipshop-product-search/SKILL.md:38
Finding: Potential Shell Command Injection Through Unsafely Interpolated Search Keywords<![CDATA[ ## Vulnerability Details **File Locations**: - `vipshop-product-search/SKILL.md:38-44` - `vipshop-product-search/SKILL.md:124` - `vipshop-product-search/README.md:94` - `vipshop-product-search/README.md:344-361` **Vulnerability Type**: User-controlled input inserted into command-line templates without required safe argument handling **Risk Level**: High ### Vulnerable Code Snippet The skill directs the Agent to construct commands from a user-provided search keyword: ```bash vipshop search-product --query "<keyword>" [--page-offset <offset>] [--price-min <min>] [--price-max <max>] ``` The automatic post-login command contains malformed quoting: ```bash vipshop search-product --query "<keyword>`" ``` The README also provides an unquoted command template: ```bash vipshop search-product --query <keyword> [--page-offset <offset>] [-p <offset>] [--price-min <min>] [--price-max <max>] ``` Its examples encourage direct insertion of search terms: ```bash # First page vipshop search-product --query dress # Second page vipshop search-product --query dress --page-offset 20 # Price filtering vipshop search-product --query dress --price-min 100 --price-max 300 # Pagination and price filtering vipshop search-product --query dress -p 20 --price-min 50 --price-max 200 ``` ### Technical Analysis The search keyword originates from the user and is therefore untrusted. The skill does not require the Agent to invoke the CLI with a structured argument array, disable shell processing, validate the keyword, or escape it for the active shell. Quoting a value in a command template is not a reliable defense. An attacker may supply quote characters, command substitutions, shell separators, redirection operators, or newline characters that terminate the intended argument and introduce another command. The malformed mixed quote in the automatic post-login command further increases the risk of inconsistent interpretation. For example, a shell-based implementation tha ...[truncated 2005 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Never build shell commands by concatenating the user's keyword into a command string. 2. Invoke the executable through a structured process API with shell processing disabled. Conceptually: ```javascript spawn( "/verified/path/to/vipshop", ["search-product", "--query", keyword], { shell: false } ); ``` 3. Require the Agent integration to pass each option and value as a separate argument. 4. Use an absolute, verified path to the CLI to avoid command search-path spoofing. 5. Validate search keywords before execution: - Enforce a reasonable maximum length. - Reject control characters and null bytes. - Normalize Unicode where appropriate. - Treat metacharacters as literal search text, not executable syntax. 6. Validate numeric parameters separately: - Accept only finite non-negative values for price filters. - Accept only valid integer offsets. - Enforce upper bounds to prevent resource abuse. 7. Correct the malformed command: ```bash vipshop search-product --query "<keyword>" ``` This correction improves documentation consistency but must not replace structured argv execution. 8. Add explicit instructions that command tools invoking `/bin/sh`, `bash -c`, `cmd.exe /c`, or PowerShell command strings are prohibited for this operation. 9. Add automated tests using adversarial keywords containing quotes, semicolons, command substitutions, redirections, newlines, and platform-specific metacharacters. 10. Ensure logs do not record sensitive command context or authentication values when rejecting malformed input. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Vague Triggers

High

Confidence: 95% confidence
Finding: The top-level description says the assistant should activate whenever users mention broad topics like shopping, styling, fashion trends, or product search. Those triggers overlap heavily with ordinary conversation, which can cause the skill to be invoked without clear user intent and expand its access to login state and downstream shopping actions more often than necessary.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill instructs proactive invocation based on vague phrases like '想买东西', '怎么穿搭', and '最近流行什么', which are common conversational expressions and not explicit authorization to use the Vipshop skill. In context, this is more dangerous because the skill is designed to chain into search, promotions, and automatic login behavior, so an overbroad trigger can initiate account-related flows from casual chat.

Ssd 3

High

Confidence: 98% confidence
Finding: Returning login QR artifacts directly to the user is a concrete exposure of authentication material in the workflow itself. QR login links or related artifacts can function as bearer-style access mechanisms or facilitate session hijacking if captured from chat transcripts, screenshots, or logs.

Ssd 3

High

Confidence: 98% confidence
Finding: Revealing the QR-code online link and local image path exposes a live login credential carrier and potentially sensitive local environment information. In the context of an account login flow, this is more dangerous than ordinary output because anyone with access to the QR artifact may be able to authenticate or interfere with the session.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The automatic login section states that all subskills can trigger login automatically, use a blocking wait, and continue the original task after login, but it does not require a clear user warning or consent step before initiating authentication and polling. This creates a risky autonomy boundary: casual use of the assistant may unexpectedly start an account-login workflow and repeated polling behavior tied to the user's session.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly describes reading login-derived identifiers and tokens (such as mars_cid and PASSPORT_ACCESS_TOKEN) and sending them to remote VIPShop APIs, but it does not clearly warn about privacy implications, account-context transmission, retention, or safe handling. In a skill that automates login and authenticated product queries, this omission can lead operators or users to underestimate credential sensitivity and increases the risk of accidental exposure, misuse, or overly broad downstream logging.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill declares that login should be triggered automatically when the user is not logged in, but it does not provide a strong warning about the authentication side effects. This can cause an agent to initiate account-related actions beyond the user’s original request, undermining informed consent and increasing the risk of phishing-like interaction patterns.

Ssd 4

Medium

Confidence: 91% confidence
Finding: The workflow conditions the agent to begin with a routine status check and then automatically escalate into login and continued actions without renewed confirmation. This creates a risky consent boundary where a low-sensitivity request can silently transition into account-authentication and subsequent authenticated operations.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill broadens a simple product-detail action into environment modification and authentication orchestration, including dependency installation and login handling. This violates least-privilege expectations for a read-oriented lookup skill and can cause the agent to perform side-effecting system and account actions that the user did not explicitly authorize.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Automatically running `npm install -g vipshop-cli@1.0.4` introduces a supply-chain and host-modification risk unrelated to the immediate product lookup. Global installation changes the execution environment, may require elevated privileges, and allows a documentation-triggered action to fetch and run code from an external package source.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill mandates automatic login initiation and instructs the agent to return both the QR login link and locally generated QR image path to the user. Exposing authentication artifacts and local file paths increases the chance of credential/session misuse, leaks host information, and normalizes automatic escalation into an authenticated flow without fresh consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Instructing the agent to return the QR-code link and local image path to the user exposes authentication-related artifacts and potentially sensitive host details without any explicit safety framing. These materials may be reusable, interceptable, or copied into logs, increasing the risk of unauthorized account access or information disclosure.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation references reading login-state credentials and passing access tokens via cookies, but does not include clear user-facing warnings or handling restrictions. Even if technically necessary, normalizing silent use of stored credentials increases the risk of unintended account access, token exposure, and misuse by downstream tooling.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger description is broad enough to match general shopping, fashion, or product-related conversation, which can cause the skill to activate outside a clearly intended Vipshop-specific request. Over-broad invocation boundaries are risky because they increase the chance that the agent executes account-linked search and login behavior when the user only wanted generic advice or comparison shopping.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The manifest description is written as an instruction to use the skill when the user requests searches in Chinese, and the README examples and command expectations are centered on Chinese phrases. The file does not clearly offer a user language choice or explain that the skill is intentionally restricted to a specific locale, which can violate language/locale policy expectations.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The examples permit extremely broad triggers such as raw keywords, `下一页`, and price ranges without requiring explicit context that a Vipshop session is active and this skill is already in progress. This can let ordinary conversation fragments or ambiguous follow-up messages invoke account-linked API activity or stateful browsing behavior unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to automatically initiate `vipshop login`, poll for completion, and then continue searching without a fresh user confirmation. For a product-search skill, this expands scope from passive retrieval into account-authentication orchestration, increasing the chance of unintended account actions and user confusion about when authentication is being triggered. The context makes this more concerning because the same skill also remembers search state and continues actions automatically after login.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README normalizes automatic login initiation and continuation of the search workflow without a clear point-in-time opt-in from the user. This is dangerous because it obscures when account authentication begins and when account/session-linked data will be used, reducing user control over a privileged flow.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The interface documentation lists `PASSPORT_ACCESS_TOKEN`, `mars_cid`, and `user_id` usage but does not provide a clear privacy warning that search and detail requests are tied to the user's authenticated Vipshop account. In this context, omission matters because the skill is not merely public web search; it transmits session-linked identifiers to external APIs and could expose account-associated behavior without adequate disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to automatically initiate authentication and to return both the QR code URL and the locally generated QR image path to the user. This is risky because it triggers an account login flow without explicit user confirmation and exposes authentication artifacts or local file locations that may reveal sensitive environment details or be misused in shared chat contexts.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to check for a missing CLI and globally install `vipshop-cli` with `npm install -g`, then execute local commands, but the skill metadata does not clearly warn that it may modify the host environment. Automatic global installation and command execution can alter system state, introduce supply-chain risk, and violate least-privilege expectations for an assistant skill.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill's stated purpose is promotion search, but it mandates automatic login initiation and login-flow handling whenever the user is not authenticated. This broadens the skill from read-only information retrieval into account-access orchestration without explicit consent, increasing the chance of unintended credential or session exposure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly requires the agent to start login automatically and proceed with later steps without waiting for user confirmation. That bypasses normal consent boundaries for account-affecting actions and can condition an agent to perform sensitive operations simply because a skill instructs it to do so.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to install a global npm package (`npm install -g vipshop-cli@1.0.4`) before performing a simple promotion lookup. Allowing a skill to expand its own execution environment by installing software increases supply-chain and arbitrary-code-execution risk, especially because npm install scripts may run with the agent's privileges.

Ssd 4

Medium

Confidence: 94% confidence
Finding: This section lays out a multi-step sequence that directs the agent to detect login state, automatically escalate into login, expose QR artifacts, and then continue execution. Such staged instructions normalize privilege escalation from simple search to authenticated account actions without a separate trust decision, which is unsafe in a skill file treated as untrusted input.

Static analysis

No suspicious patterns detected.