Security audit

京东精选

Security checks across malware telemetry and agentic risk

Overview

This shopping skill is purpose-aligned and disclosed, but users should understand that their shopping queries are sent through the publisher's Tencent Cloud proxy.

Install only if you are comfortable sending JD shopping intent, keywords, price filters, and channel choices through the publisher's Tencent Cloud proxy. The skill does not appear to buy items, modify accounts, read local files, or persist data, but the publisher should ideally remove the embedded proxy token and document proxy data handling more clearly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares environment-backed proxy configuration and explicitly routes requests through a cloud proxy, but no permissions or trust boundaries are declared. This creates a real security and privacy concern because users and the platform cannot easily assess that network access and secret-backed external forwarding are required, and proxy infrastructure can observe queries or be changed independently of the skill manifest.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code embeds a default proxy authentication token directly in the skill, which creates a reusable credential inside distributed source code. Anyone with code access can extract and abuse that token to access the proxy service, and the skill description does not clearly disclose this authenticated third-party forwarding behavior to users.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrase "京东有什么好货" is broad, natural shopping language that could overlap with ordinary user conversation and unintentionally activate the skill. Unintended invocation can cause unexpected external queries, expose user shopping intent to a third-party proxy/API, and crowd out more specific or trusted skills.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Telling users to "say the channel name" relies on ambiguous, single-word phrases like "秒杀" or "补贴," which are likely to appear in normal shopping dialogue. This increases the risk of accidental invocation or cross-skill triggering, especially because the skill can then make network requests through a proxy and return externally sourced content.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: A hardcoded default proxy token is automatically used for outbound requests whenever the environment variable is absent, so the skill will still operate with an embedded credential. This weakens secret management, makes unauthorized reuse more likely, and hides authenticated third-party data transfer from both deployers and users.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.