Category Selection

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate Amazon category-analysis purpose, but it needs review because it automatically uses Sorftime credentials and can generate report files where third-party data may execute as browser script or spreadsheet formulas.

Install only if you are comfortable giving the skill access to a Sorftime API key and sending category/product queries to Sorftime. Treat generated HTML, CSV, and Excel reports as untrusted files until the publisher fixes HTML/script escaping, innerHTML rendering, spreadsheet formula neutralization, and safer credential handling.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_reports.py:583

Finding

Stored HTML and JavaScript Injection in Generated Dashboard

Content

View full analysis

Remediation

View remediation

{ const row = tableBody.insertRow(); appendTextCell(row, index + 1); appendTextCell(row, product.asin); appendTextCell(row, product.title); appendTextCell(row, product.brand); appendTextCell(row, `$${product.price}`); appendTextCell(row, product.rating); appendTextCell(row, product.sales); appendTextCell(row, `${product.marketShare}%`); }); ``` 2. Store serialized data in a non-executable element: ```html ``` Parse it using: ```javascript const reportData = JSON.parse( document.getElementById('report-data').textContent ); ``` 3. Before embedding JSON in HTML, escape HTML-significant and script-sensitive characters. At minimum, transform `<`, `>`, `&`, U+2028, and U+2029 into Unicode escape sequences. This prevents literal `` sequences from appearing in the generated file. 4. Apply contextual HTML escaping to direct replacements such as category names, site names, ratings, and seller summaries. 5. Validate API response fields against a strict schema, including expected types and maximum lengths. 6. Add a restrictive Content Security Policy. Prefer a locally bundled script and avoid inline JavaScript so that `script-src 'self'` can be enforced without `unsafe-inline`. 7. Add regression tests using payloads containing ``, event-handler attributes, HTML entities, quotes, backticks, and Unicode line separators. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_reports.py:155

Finding

CSV and Excel Formula Injection Through API-Controlled Product Fields

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/workflow.py:615

Finding

Sorftime API Key Exposed Through URL Query Strings and Process Arguments

Content

View full analysis

dict: self.request_id += 1 args_str = json.dumps(arguments, ensure_ascii=False) cmd = [ 'curl', '-s', '-X', 'POST', API_URL, '-H', 'Content-Type: application/json', '-d', f'{{"jsonrpc":"2.0","id":{self.request_id},' f'"method":"tools/call","params":{{"name":"{tool_name}",' f'"arguments":{args_str}}}}}' ] result = subprocess.run( cmd, capture_output=True, text=True, timeout=120, encoding= ...[truncated 2533 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch explicitly matters because the skill is framed as benign category-analysis logic while depending on and processing external Sorftime SSE/API data through offline scripts. Hidden external dependencies and data ingestion paths increase risk: users may not expect third-party transmission, local artifact creation, or parser exposure when invoking what appears to be a simple analysis skill.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

| `workflow.py` | 一键执行完整分析流程 | **v4.0** |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

md

| `workflow.py` | 一键执行完整分析流程 | **v4.0** |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/category-api-reference.md (reported line 14)May include surrounding context.

用途: 根据品类名称查找对应的类目nodeid

bash

curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"site":"US","searchName":"sofas"}}}'

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The code unconditionally reads sensitive credentials from a local .mcp.json file in the current working directory, which gives the skill access to secrets the user may not expect it to consume. In an agent skill context, this is more dangerous because skills often run with ambient file access, so a seemingly harmless analysis command can silently harvest local credentials and immediately use them for outbound requests.

Content

Scanner excerpt · scripts/analyze_category.py (reported line 33)May include surrounding context.

python

def _load_api_key(self) -> str:
        """从配置文件加载 API Key"""
        config_file = Path(".mcp.json")
        if config_file.exists():
            with open(config_file, 'r', encoding='utf-8') as f:
                config = json.load(f)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The changelog describes logic that automatically reads an API key from .mcp.json, which is a credential-bearing local configuration file, without indicating user consent, scope restriction, or masking/handling safeguards. In an agent skill context, implicit credential discovery expands the trust boundary and can lead to unintended secret use or later leakage through logs, errors, or downstream requests.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents and encourages capabilities including shell execution, network access, local file read/write, and environment/config access, but it declares no explicit tool scope or permissions boundaries. In an agent setting, this can cause over-broad execution authority and makes it easier for the skill to access credentials, write files, and call external services without clear user awareness or enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language triggers are broad enough that ordinary requests about category analysis may invoke a skill with shell, filesystem, credential-read, and network behaviors. Overbroad activation is dangerous in agent environments because it can cause sensitive actions to run in contexts where the user intended only generic discussion or lightweight advice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly states it will automatically read API keys from .mcp.json without an explicit user warning or consent step. Automatic credential discovery is sensitive because it normalizes secret access and can expose or misuse tokens in workflows that also perform external network requests to third-party services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This documents outbound transmission to an external Sorftime endpoint using an API key in the URL and request body data. External transmission is expected for this skill's purpose, but it is still security-sensitive because category inputs, identifiers, and credentials are sent to a third party, and URL-based API keys can be leaked via logs, shell history, proxies, or monitoring systems.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

调用格式

bash

curl -s -X POST "https://mcp.sorftime.com?key=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{"amzSite":"US","nodeId":"NODE_ID"}}}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger section defines ambiguous activation conditions without clear boundaries, which can lead to accidental execution of an operational workflow. Given that the workflow includes external API calls and local file generation, accidental triggering raises the risk of unapproved data transmission and unintended side effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This is another documented external API call to the Sorftime service, again including the API key in the URL. The main risk is credential leakage and unreviewed third-party data sharing, especially since the skill also encourages automated execution and key retrieval from local configuration.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

步骤 1: 搜索类目获取 nodeId

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"品类关键词"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill continues to instruct outbound requests to the external Sorftime API with credentials embedded in the URL. Repetition increases the likelihood that insecure patterns are copied into real use, propagating secret exposure through logs and command history.

Content

Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.

获取 NodeID 的方法:

bash

# 先用大类目搜索，查看返回的子类目列表
curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Laptop"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The API connectivity test again sends requests to a third-party endpoint with the key in the query string. Even if intended for troubleshooting, diagnostic commands are often pasted into terminals and CI logs, making credential leakage and unauthorized external transmission more likely.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

5. 测试 API 连接:

bash

curl -s -X POST "https://mcp.sorftime.com?key={YOUR_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Kitchen"}}}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML document is explicitly fixed to lang="zh-CN", and the visible report text throughout the template is in Chinese. This creates a natural-language locale constraint with no indication that users can opt into another language or that the template is intentionally limited to a China-specific or Chinese-only use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown template is entirely written in Chinese, including the title and all section headings, which indicates the skill will produce reports in a fixed language. The file does not mention any user opt-in, language selection, or region-specific justification, so it appears to impose a locale choice unconditionally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-quick-reference.md (reported line 8)May include surrounding context.

1. category_name_search - 搜索类目

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Sofas"}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation shows API authentication via a query-string parameter (?key={API_KEY}), which is commonly exposed through browser history, shell history, logs, proxies, monitoring systems, and referrer-like telemetry. Even though this is only a reference document, publishing the pattern without any warning normalizes an unsafe credential-handling practice and can lead users to leak real API keys.

Content

No source excerpt is available for this finding.