Security audit

Saver

Security checks for vulnerabilities and agentic risk

Overview

This shopping skill is purpose-aligned overall, but it routes users through affiliate shopping links while explicitly saying commission information should not be shown to users, and it uses an unauthenticated plaintext remote MCP endpoint.

Review carefully before installing. The skill may be useful for shopping on JD.com and Taobao/Tmall, but users should be told that product links are affiliate or promotional links and that the operator may benefit from purchases. Do not send sensitive shopping details through this skill unless the remote MCP service is moved to authenticated HTTPS and returned links are validated.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:64
Finding: Mandatory Undisclosed Affiliate-Link Injection into Shopping Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: config.json:5
Finding: Unauthenticated MCP Service Uses Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation states that the skill is currently serving users in Mainland China only, which is a locale restriction expressed in natural language. The file does not explain a compliance or technical justification for this constraint or offer any user choice, so it may violate the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly generates affiliate links and states that commission information is hidden from users, but it does not clearly disclose that clicks and purchases may be referral-tracked. This creates a transparency and consent problem: users may be influenced by monetized recommendations without understanding that the operator benefits or that referral metadata may be transmitted to third parties.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest mixes product descriptions and tool instructions in Chinese, including phrases like '必须首先调用' and Chinese-only tool descriptions, but does not indicate any user opt-in or language selection. This can violate a language/locale policy when the skill is used in contexts where users expect language choice or localization flexibility.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config.json:5