京东自营9.9包邮

Security checks across malware telemetry and agentic risk

Overview

The skill is a product-query helper, but its bundled backend code and product claims are broader than the user-facing description.

Install only if you are comfortable with the skill sending queries to the publisher’s cloud proxy and with recommendations that may include flagship-store items despite self-operated-only wording. The publisher should narrow the backend API, remove or rotate the embedded token, and align the product claims with the actual filters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata describes a narrowly scoped 9.9包邮 self-operated product query tool, but the code exposes additional generic affiliate proxy endpoints such as goods_query, material, category, activity, and promote. This expands the reachable functionality beyond the declared scope, which can mislead integrators and enable unintended data access or affiliate operations.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The implementation permits callers to query arbitrary eliteId channels and generic goods search results, including non-self-operated items, despite the skill description claiming only curated 京东自营 9.9包邮 goods. In a skill context, this mismatch is security-relevant because downstream agents or users may trust declared constraints that are not actually enforced.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The formatter derives `is_self` from `isJd == 1` or whether the shop name contains the string `自营`, but it does not enforce or verify that every returned item is truly JD self-operated. Because the tool’s summary text repeatedly tells users results are `京东自营商品`, any upstream proxy mistake, spoofed `shopName`, or policy drift could cause mislabeled third-party items to be presented as trusted self-operated goods.

Intent-Code Divergence

Medium
Confidence
79% confidence
Finding
The module comments say the SCF hard-filters `自营/旗舰店`, while user-facing copy later claims items are `京东自营商品`. This mismatch can mislead users into trusting the provenance and fulfillment model of recommended products, which matters in an e-commerce context where self-operated versus marketplace items have different trust, return, and service expectations.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill advertises itself as a narrow 9.9包邮商品查询工具, but the implementation exposes multiple broader JD affiliate proxy operations including goods search, material, activity, category, and promotion link conversion. This expands the tool's authority beyond user expectations and can be abused to access affiliate functionality not implied by the manifest.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The code permits non-9.9 queries by accepting arbitrary request types and by allowing jingfen requests with eliteId values other than the dedicated 9.9 channel. This undermines the declared scope and lets callers use the service as a general JD affiliate proxy rather than a constrained recommendation tool.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest claims only 京东自营商品 are returned, but the hard filter explicitly also keeps 旗舰店 items. This is a scope-integrity problem: downstream agents or users may rely on stricter provenance guarantees than the code actually enforces, leading to deceptive or policy-violating recommendations.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest says the skill is curated to 98%+ positive ratings, but the cache-layer hard filter only enforces 97%, with 98% applied later as a dynamic filter. This mismatch weakens the claimed quality guarantee and can allow lower-rated items into cached data or alternate paths, reducing trust in the tool's stated selection criteria.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
Promotion link conversion enables generation of affiliate tracking links, which is materially broader than a read-only low-price product query tool. In a skill presented as a recommendation/search utility, this hidden capability increases abuse potential for unsolicited affiliate redirection or monetization workflows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
A hardcoded proxy token is embedded directly in source and sent on every outbound request. Anyone with code access can extract and reuse the credential to call the backend service, potentially leading to unauthorized use, abuse of the proxy, quota exhaustion, or access to cached data and service behavior not intended for the public.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal