T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:220- Finding
Remote Backend Controls the Agent's Primary User-Facing Response
- Content
View full analysis
- Remediation
View remediation
Security audit
用户询问回收、估价、报价、回收价、值多少钱、能卖多少、转转回收时触发，支持全品类商品回收估价，结合图片、文字、型号、规格、成色等信息给出参考回收价
Security checks for vulnerabilities and agentic risk
Overview
This recycle-estimate skill does what it claims, but it gives a remote service and caller-controlled endpoint too much influence over user data and final answers.
Review before installing. Use this only if you are comfortable sending valuation text and product photos to the Zhuanzhuan service, avoid passing arbitrary local files as images, and do not use --base-url except with a trusted approved endpoint. Treat backend-generated reply text as untrusted content if you maintain or wrap this skill.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/invoke_zhuanzhuan_recycle_skill.py:361- Finding
Arbitrary Destination Override Can Exfiltrate User Data and Session Identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The English long description says the skill should be 'triggered aggressively' for broad, everyday resale-value phrasing. This materially raises the risk of unintended invocation across normal shopping, appraisal, or casual 'what is this worth' conversations, which can lead to incorrect routing, unnecessary data handling, and degraded trust in the agent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README presents a Chinese-first structure with a dedicated “中文版” section but does not state that language is user-selectable or that Chinese is required for a region-specific reason. Under the stated policy, forcing a specific language or locale without opt-in can be a natural-language policy issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states the skill should match broad phrases such as '回收', '估价', '值多少钱', and similar resale-related wording. Broad trigger guidance can cause the orchestrator to invoke this skill in ambiguous conversations, increasing the chance of misrouting user requests and exposing user-provided images or product details to an unintended skill path.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill advertises executable capabilities through shell, file, environment, and network use, but does not declare any explicit tool scope or permission boundaries. In practice, this creates an over-privileged integration where the runtime may permit broader access than reviewers or policy expect, increasing the blast radius of prompt injection, SSRF, local file exposure, or unsafe state handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description and the rest of the document are written as if the skill operates only in Chinese, but there is no opt-in or user-choice mechanism for language or locale. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless clearly documented as a justified regional constraint.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger list includes very broad resale-related phrases like '值多少钱', '卖掉', and '闲置', which can appear in many ordinary conversations outside the intended recycle-estimation flow. This can cause unintended activation, sending unrelated user text or images to the recycle backend and creating privacy, consent, and misrouting risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly says it should trigger even when the product category is not clearly stated, based only on partial descriptors or images. That lowers the threshold for activation and increases the chance that unrelated content, sensitive photos, or vague messages are processed by the skill without sufficient user intent validation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains user-facing natural-language strings such as the module docstring, argparse descriptions, warnings, and output text entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _has_command(cmd): """检查系统命令是否可用。""" try: subprocess.run([cmd, "--version"], capture_output=True) return True except FileNotFoundError: return False
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def _compress_with_sips(image_path, tmp_path, max_dim, quality): """macOS sips 压缩。""" subprocess.run( [ "sips", "-s", "format", "jpeg",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 82% confidence
- Finding
The script invokes ImageMagick's convert on attacker-controlled local files. Even without shell injection, ImageMagick has a long history of delegate/protocol and file parsing issues, so processing untrusted images can lead to SSRF, local file reads via coders/delegates, or code execution depending on policy and version.
- Content
python def _compress_with_convert(image_path, tmp_path, max_dim, quality): """ImageMagick convert 压缩（Linux 常用）。""" subprocess.run( [ "convert", image_path,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The --base-url argument allows a caller to redirect outbound requests to any host, turning this skill into a generic HTTP client. In an agent context, that can be abused for SSRF-like access to internal services, data exfiltration of user text/images/session tokens, or bypass of intended domain restrictions.
- Content