Security audit

美团优惠券

Security checks for vulnerabilities and agentic risk

Overview

This coupon-search skill matches its stated purpose, but it needs review because it ships a reusable proxy token and trusts remote coupon content in rendered links and images.

Review this before installing. It sends coupon search terms to a remote Tencent Cloud Function and returns remote images and purchase links. The publisher should rotate/remove the exposed proxy token, document the network behavior, narrow routing to explicit coupon searches, and validate or escape remote coupon fields before rendering them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:8
Finding: Hard-Coded Proxy Authentication Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:249
Finding: Untrusted Remote Content Rendered as Unsanitized Markdown
Content: View full analysis
str: """格式化单个优惠券""" name = product.get("name", "") brand = product.get("brandName", "") sell_price = _format_price(product.get("sellPrice")) original_price = _format_price(product.get("originalPrice")) img = product.get("headUrl", "") sale_volume = product.get("saleVolume", "") sp = _safe_float(product.get("sellPrice"), 0) op = _safe_float(product.get("originalPrice"), 0) saved = op - sp if op > sp > 0 else 0 if saved > 0: price_line = f"{sell_price}（省{_format_price(saved)}） ← {original_price}" else: price_line = sell_price labels = [] beat_label = product.get("beatMTLabel", "") if beat_label: labels.append(f"🔥{beat_label}") price_label = product.get("pricePowerLabel", "") if price_label: labels.append(f"📉{price_label}") label_str = " | ".join(labels) if labels else "" lines = [] if brand and brand not in name: lines.append(f"🏷 {brand}") lines.append(f"**{name}**") lines.append(f"💰 {price_line}") if label_str: lines.append(label_str) if sale_volume: lines.append(f"📦 {sale_volume}") if img: lines.append(f"![{name}]({img})") if referral_link: lines.append(f"🛒 [立即购买]({referral_link})") return "\n".join(lines) ``` ### Technical Analysis The coupon fields originate from a remote proxy response and are treated as trusted presentation content. Product names, brand names, labels, image URLs, and referral URLs are interpolated directly into Markdown. No Markdown escaping is applied to text fields. In addition, `headUrl` and `referral_link` are not checked for an approved scheme or trusted hostname. If the ...[truncated 2438 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill invokes a local Python entrypoint and the analyzer detected network capability, but the manifest does not declare any explicit tool scope or permission boundary. This creates an authorization and transparency gap: reviewers and the host may not be able to constrain or clearly understand what external access the skill may perform when processing user-supplied search terms.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is broad enough to trigger on many generic requests about discounts, coupons, food, or services, which can cause the skill to be invoked outside narrow user intent. Over-broad routing is dangerous because it can unnecessarily expose user queries to this skill and any backing network/tooling, increasing data-sharing and mis-execution risk even if the skill itself is not overtly malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file-level description is written entirely in Chinese and the skill's user-facing outputs throughout the code are hard-coded in Chinese, indicating the skill is designed to operate only in that language. There is no natural-language notice, opt-in, or fallback giving users a language/locale choice, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill embeds a live proxy authentication token directly in source code and then sends it as an HTTP header on every request. Anyone with access to the code can reuse the token to call the proxy service, potentially abusing the backend, consuming quota, or accessing data/functions intended only for this skill.
Content: No source excerpt is available for this finding.