Category Selection

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate market-analysis skill, but it needs review because it automatically uses local Sorftime API credentials and sends them in URL-based external requests.

Install only if you intend to use Sorftime for Amazon category research and are comfortable letting the skill read your Sorftime API key from SORFTIME_API_KEY or .mcp.json. Use a limited key if possible, avoid pasting real keys into copied curl examples, and review generated raw response files and logs before sharing reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents shell execution, network access, file read/write, and environment/credential access, but declares no permissions or user-facing warning about those capabilities. This creates a transparency and consent problem: users may invoke what appears to be a simple analysis skill while it performs broader local and external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The manifest says the skill performs Amazon category analysis and generates a Markdown report, but the body documents significantly broader behavior: external API calls, API key loading from local config, multiple output formats, raw/intermediate data retention, keyword/trend processing, and support beyond Amazon. This mismatch undermines informed consent and can hide data handling and credential usage that users would not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatically reading API keys from `.mcp.json` is a credential-access capability that is more sensitive than the skill's advertised analytical function suggests. Even if intended for convenience, accessing local config secrets increases the risk of unauthorized secret use and unexpected outbound requests authenticated as the user.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The workflow also documents access to the `SORFTIME_API_KEY` environment variable, which is another credential-reading path not prominently disclosed in the skill's stated purpose. This expands the attack surface for secret use and makes the skill capable of acting with externally authenticated privileges without clear user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The skill claims to be for Amazon category analysis, but documentation states support for TikTok and 1688 as well. This undocumented scope expansion matters because it broadens data sources, workflows, and possible transmissions beyond what the user would infer from the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill reads an API key directly from the project's .mcp.json, which is a sensitive configuration source outside the immediate user input for category analysis. This broadens the skill's access to credentials and enables silent reuse of stored secrets without explicit user consent or clear need boundaries.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The natural-language triggers are broad enough to match ordinary market-research requests, increasing the chance the skill activates unexpectedly. Because the skill can perform network requests, read credentials, and write many files, over-broad activation raises real security and privacy concerns rather than being just a UX issue.

Vague Triggers

Low

• Confidence: 76% confidence
• Finding: The trigger conditions omit negative examples and clear non-activation boundaries, so the agent may invoke the skill in ambiguous contexts. In a skill that performs external calls and local writes, ambiguity increases the chance of unintended side effects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The description does not clearly warn that the skill may automatically call external APIs, load API keys from local configuration/environment, and generate multiple local output artifacts. Missing side-effect disclosure prevents informed consent and can surprise users with network transmission and persistent local data creation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation demonstrates passing the API key in the URL query string, which is commonly logged by shells, proxies, browser/history tooling, and server access logs. Even though the example uses a placeholder, it teaches an unsafe credential-handling pattern that can lead to accidental secret exposure when users copy it into real workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples place the API key in the request URL query string, which is commonly captured in shell history, proxy logs, browser history, monitoring systems, and server access logs. Even though this is documentation rather than executable code, it teaches an insecure credential-handling pattern that can lead to credential exposure when users copy the example verbatim.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation instructs callers to place the API key in the URL query string, which is commonly logged by clients, proxies, gateways, browser history, and observability systems. This increases the chance of credential disclosure and unauthorized API use, especially in agentic systems that may record full request URLs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script automatically extracts an API key from a local .mcp.json file and appends it to the request URL as a query parameter. Query-string secrets are more likely to be exposed via logs, proxies, browser/history-like tooling, and monitoring systems, and the key is sent without any explicit user disclosure or consent flow.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script extracts the API key and appends it into the request URL query string. Secrets placed in URLs are commonly exposed through logs, process listings, browser/history equivalents, proxies, and diagnostics, making credential leakage significantly more likely.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The workflow sends user-supplied category queries and retrieved report requests to an external Sorftime endpoint without an explicit user-facing notice or consent flow. In a skill context, silent external transmission can violate least surprise and create privacy/compliance issues, especially when users may assume local-only analysis.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 调用格式
```bash
curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{"amzSite":"US","nodeId":"NODE_ID"}}}'
```

• Confidence: 87% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

#### 步骤 1: 搜索类目获取 nodeId

```bash
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"品类关键词"}}}'
```

• Confidence: 87% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","argument

External Transmission

Medium

• Category: Data Exfiltration

Content

**获取 NodeID 的方法**:
```bash
# 先用大类目搜索，查看返回的子类目列表
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Laptop"}}}'
```

• Confidence: 87% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

5. **测试 API 连接**:
```bash
curl -s -X POST "https://mcp.sorftime.com?key={YOUR_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Kitchen"}}}'
```

• Confidence: 87% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key={YOUR_KEY}" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. category_name_search - 搜索类目

```bash
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Sofas"}}}'
```

• Confidence: 90% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","argument

External Transmission

Medium

• Category: Data Exfiltration

Content

### 3. product_detail - 产品详情

```bash
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product_detail","arguments":{"amzSite":"US","asin":"B0DDTCQGTR"}}}'
```

• Confidence: 90% confidence
• Finding: curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product_detail","arguments":{"a

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.