台州景区热度榜

• Outcome: Review
• Latest audit: Sep 22, 2026 · 4:59 PM UTC
• Version: 1.0.21

Overview

The skill appears aimed at legitimate Taizhou tourism data retrieval, but it quietly stores and sends product credentials and session cookies without clear user-facing disclosure.

Before installing, understand that this skill contacts an external service for live data and may create a plaintext credential/session file in your home directory. Use it only if you trust the publisher and are comfortable with product API keys, cookies, and an install identifier being stored locally and sent back to the service for quota or paid access checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The comment at L015 says the skill does not collect device information and only stores a random install identifier and API key. However, the implementation immediately uses `homedir()` and writes a product-specific credential file under the user's home directory, which is host/user-environment-derived local context and persistence behavior not reflected by the comment. This is an active mismatch between the documentation's privacy/persistence framing and the code's behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script silently creates and writes a credential file containing API keys, cookies, and install identifiers in the user's home directory without any notice or consent prompt. This can surprise users, increase exposure of sensitive tokens on shared systems, and make incident response harder because persisted secrets remain after execution.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script automatically sends locally stored API credentials, cookies, and install identifiers to a remote host without explicit runtime disclosure. In a skill context, this is more sensitive because users may expect simple content retrieval, not silent transmission of persistent identifiers and authentication material to an external service.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The manifest presents the skill entirely in Chinese via its name and tags, which can indicate a fixed language/locale assumption. Because there is no visible opt-in, alternative locale, or justification that the skill is intentionally region-specific beyond the place name itself, this may violate language-choice policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: Multiple comments and all console messages are written only in Chinese, and the script provides no mechanism for language selection or user opt-in. This can violate language or locale policy when a skill is expected to avoid forcing a specific language without explicit choice.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: At L022, the inline comment states 'environment variable first', implying environment-based credential sourcing. But `API_KEY` is derived only from `cred.api_key` loaded from the local JSON file, and there is no `process.env` access anywhere in the file. This is a direct contradiction between the code comment and actual behavior.

Static analysis

No suspicious patterns detected.