Alibaba Supplier Outreach

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:44 PM UTC
• Version: 1.0.0

Overview

This skill automates Alibaba supplier outreach, but its sensitive actions are aligned with that purpose and gated by user selection and message approval.

Before installing, understand that this skill can use your logged-in Alibaba session to read messages and send supplier inquiries or replies after approval. It also keeps local negotiation notes in ~/.claude/supplier-conversations, so avoid using it on shared machines or delete those logs if they contain sensitive pricing or supplier information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough that ordinary user input like a product name or casual mention of follow-up could activate messaging or negotiation flows unexpectedly. In a skill that can navigate logged-in sessions and send supplier messages, ambiguous activation increases the chance of unintended external actions.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Treating a bare product keyword as sufficient to enter OUTREACH mode is risky because a minimal prompt can start a workflow that researches suppliers and prepares communications. In this context, the skill operates on a logged-in Alibaba session and can progress toward contacting third parties, so ambiguous activation is materially more dangerous than in a read-only skill.

Session Persistence

Medium

• Category: Rogue Agent

Content

| 2 | ...

Which do you want to contact? (e.g. "1, 2, 3" or "top 3")
What message style? [A] Auto-generate optimized quote request  [B] I'll write my own
```

---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs persistent local storage of supplier names, message content, pricing targets, and negotiation history without notifying the user or obtaining consent. This creates privacy and data-governance risk, especially on shared machines or environments where local files may be backed up, synced, or accessed by other tools.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The rules section states 'Always show messages to user before sending — never auto-send,' which communicates a no-auto-send policy for all messages. However, the outreach workflow tells the operator to show the message for approval and then proceed through automated send steps, creating a direct contradiction between documented intent and prescribed behavior.

Static analysis

No suspicious patterns detected.