Security audit

Publish

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real shopping-deals skill, but it under-discloses what gets sent to its service and how affiliate-style purchase links are presented.

Install only if you are comfortable sending shopping queries, pasted product links or tokens, and optional city/category deal searches to xiaxiayouhui.xyz. Treat purchase buttons as third-party/affiliate redirects, review prices on the actual merchant site before buying, and avoid pasting URLs that contain personal tracking or account-linked parameters.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: The README states that only product keywords are transmitted, but the documented workflow also accepts and parses full product links. URLs can contain tracking parameters, referral data, and other user-specific metadata, so this is a misleading data handling claim that can cause users to disclose more information than they were led to expect. In this shopping-assistant context the impact is limited, but it is still a privacy transparency issue.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes very broad shopping-related phrases such as '帮我找', '推荐买什么', and '我想买', which can cause the skill to activate during ordinary conversation even when the user did not explicitly request this third-party service. That increases unintended data sharing to the remote service and may let the skill dominate unrelated recommendation queries. Because this skill contacts an external server and aggregates commercial content, overbroad invocation is more dangerous than for a purely local utility.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger table includes broad phrases such as “全网最低价”, “我想买 xx”, “该不该买”, and “贵不贵”, which can appear in ordinary shopping conversation and may cause the skill to activate when the user did not explicitly request price comparison or coupon aggregation. In an agent environment, overbroad invocation can leak user queries to an external service and steer responses toward this skill unnecessarily, increasing privacy and integrity risk even though the API is described as read-only.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example shows the AI sending a user’s product query to an external service and then presenting affiliate-style outbound links, but it does not clearly warn the user that their search terms are being transmitted to xiaxiayouhui.xyz. This creates a privacy and transparency issue: users may not realize their shopping intent, product interests, and click activity are being shared with a third-party aggregator and tracked through redirect links.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The example sends a user-provided shopping URL directly to an external API without any notice or consent flow. Shopping links can contain identifiers, referral parameters, campaign tokens, or other user-associated metadata, so silent transmission creates a privacy and data-sharing risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The 淘口令 example forwards a token-like user input to an external service with no warning that the code will leave the chat context. Such tokens may embed tracking, account-linked attribution, or other sensitive commerce metadata, so undisclosed sharing can expose user data and surprise users.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger keywords include broad everyday phrases such as general shopping or dining terms, which can cause the skill to activate in situations the user did not intend. Over-broad invocation increases the chance of unnecessary external requests and unintended disclosure of user query context to the third-party service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example shows a network request sending the user's city and category to an external domain, but the skill description does not clearly disclose this data flow. Users may unknowingly have location-related preference data transmitted off-platform, which creates privacy and consent risk even if the data is not highly sensitive on its own.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README provides live curl commands that send search queries and full product URLs to an external production service, but it does not warn operators that running the examples will transmit potentially sensitive user inputs off-platform. In a skill centered on link parsing and deal lookup, this creates a real privacy and data-handling risk because testers may paste real user URLs, product interests, or location data into commands without informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.