Security audit

浙江科技型中小企业名录

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Zhejiang SME roster lookup, but it persists and reuses API/session credentials for a hardcoded external service with limited user-facing disclosure.

Install only if you trust the publisher and the hardcoded data service with your roster queries and any API/session credential used for this product. Be aware it creates a plaintext credential file at ~/.odf/zj-sme-roster.json and reuses stored cookies/install IDs across runs; remove that file to clear local state.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill defines very broad trigger phrases such as '名录', '企业名单', '招商线索', and '企业线索', which overlap heavily with ordinary business queries and can cause the agent to invoke this skill outside the user's intended scope. That increases the risk of inappropriate tool activation, unnecessary external data access, and user confusion, especially because the skill is lead-generation oriented and may be selected for many unrelated enterprise-list requests.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script stores API keys, installation identifiers, and session cookies in a plaintext file under the user's home directory, then reuses them across runs. Even if intended for convenience, persisting authentication material without access controls or encryption increases the chance of local credential theft, session hijacking, and unintended tracking if the host is shared or compromised.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script sends locally stored identifiers, cookies, and optional bearer credentials to an external service on every request, creating a trust boundary crossing with persistent authentication state. This can expose sensitive tokens to a remote endpoint, enable user tracking, and magnify risk if the remote service is compromised or if the destination is not fully trusted or verified by the user.

Natural-Language Policy Violations

Low

Confidence: 87% confidence
Finding: This code includes natural-language comments and multiple console messages exclusively in Chinese, with no indication that the skill is intentionally limited to Chinese-speaking users or that users can select another language. That can violate language/locale policy when a skill imposes a specific language without opt-in.

Static analysis

No suspicious patterns detected.