T09 · Insecure Skill Coding Practices
Error
- Location
scripts/xhs_crawler.py:37- Finding
Arbitrary Python Code Execution Through Keyword Configuration Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Sentiment Radar
Security checks for vulnerabilities and agentic risk
Overview
The skill has a plausible sentiment-analysis purpose, but it includes under-scoped browser scraping and an unsafe external config rewrite that could run injected code.
Install only after review. Use a sandboxed environment and an ephemeral browser profile, pin and inspect MediaCrawler before running it, avoid untrusted keyword input, do not expose personal browser sessions or OAuth tokens unnecessarily, and define retention/redaction rules for collected social-media data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:23- Finding
Execution of an Unpinned External MediaCrawler Dependency
- Content
View full analysis
- Remediation
View remediation
``` 2. Publish the expected commit hash and verify it before installation. 3. Pin transitive Python dependencies with a committed lockfile containing integrity hashes. 4. Require signature or checksum verification for downloaded components. 5. Review the pinned MediaCrawler source and its installation hooks before execution. 6. Prevent automatic updates to an unreviewed branch. 7. Run the external crawler in a sandbox or container with narrowly scoped filesystem, browser, and network access. 8. Document a controlled upgrade process requiring review before changing the pinned revision. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The code partially matches the declared reporting goal: it does generate a structured sentiment-style report with keyword heat, product mention counts, pricing-related comment samples, comparison comment samples, and top-note summaries. However, the declared purpose emphasizes a multi-platform monitoring/analysis capability spanning XHS plus Twitter/Reddit, while the actual code only analyzes local JSON files corresponding to XHS crawl outputs. There is no evidence of English-platform support, social data collection, MCP integration, or broader cross-platform market intelligence workflows. Because the description materially overstates the scope and primary capability of the supplied code chunk, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broader sentiment-monitoring and analysis tool spanning XHS, Twitter, and Reddit, with structured reporting and insight generation. The supplied code instead implements a very specific Douyin video-search scraper. Its primary function is DOM extraction of search result cards via Playwright automation, followed by saving raw output. There is no sentiment classification, opinion aggregation, pricing complaint detection, comparison analysis, or report generation. The platform is also materially different: Douyin is not listed in the description, while the described platforms and collection methods (MediaCrawler for XHS, Xpoz MCP for Twitter/Reddit) do not appear in the code. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad sentiment intelligence skill covering Chinese and English platforms plus downstream analysis and reporting. The supplied code chunk only supports a narrow subset: crawling Xiaohongshu data via MediaCrawler and exporting JSON. While XHS collection is consistent with one part of the description, the primary described capabilities—cross-platform monitoring and sentiment/report analysis—are absent from this code. This is a material description-to-behavior mismatch rather than a mere partial implementation detail.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script explicitly uses browser automation to 'bypass API-level blocking' by attaching to a local Chrome instance over CDP and scraping a site through an interactive browser session. In an agent skill, this creates a risky capability expansion beyond ordinary sentiment analysis because it can leverage an authenticated/local browser context to access or extract data in ways not transparently declared, increasing the chance of misuse, policy evasion, and unintended data collection.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python print("ERROR: MediaCrawler venv not found. Run 'uv sync' in media-crawler/ first.") sys.exit(1) env = os.environ.copy() env["MPLBACKEND"] = "Agg" if "/usr/sbin" not in env.get("PATH", ""): env["PATH"] = f"/usr/sbin:{env['PATH']}"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs cloning repositories, reading tokens from the user's home directory, editing config files, running shell commands, and writing output files, but it declares no tool scope or permissions boundaries. That mismatch is dangerous because an agent or user may grant broader filesystem, environment, and shell access than expected, increasing the chance of unintended data exposure or command execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs collection, storage, and analysis of social-media posts and comments, including output to local JSON and reports, but provides no privacy, retention, consent, or sensitive-data-handling guidance. That omission is dangerous because social content can contain personal data, account identifiers, and sensitive opinions, and users may unknowingly create local datasets or reports that violate policy, law, or internal handling requirements.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly recommends CDP browser use 'for anti-detection' and QR-login-based crawling, which normalizes evasion of platform defenses and may induce users or agents to automate authenticated sessions in ways that violate safeguards. In a sentiment-analysis context, that guidance is riskier because the stated purpose does not require stealth or bypass-oriented operational advice, yet it encourages techniques that can capture session context and broaden account-exposure risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template hardcodes Chinese section titles and report wording, which imposes a specific language/locale on the generated report. Under the policy, locale constraints should either be optional for the user or clearly documented as justified for a region-specific use case.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes sentiment monitoring on Chinese platforms via 小红书/XHS and English platforms via Twitter/Reddit, but this file is explicitly a Douyin scraper and collects raw video search data from douyin.com. That expands the implemented platform coverage beyond what the skill claims to support.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script edits base_config.py inside an external MediaCrawler installation in place, which creates side effects outside the skill's own workspace and changes future behavior of that tool. Because it rewrites executable Python config text using unescaped user-supplied keywords, it can also corrupt the external installation or inject unintended content into the config file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script silently rewrites files in an external dependency without prominently informing the user that persistent changes will be made. In a skill context, this is risky because users may expect a read-only analysis tool, while the script alters another project's configuration and potentially affects later runs or other workflows.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script launches a separate Python interpreter from an external repository and executes its main.py with inherited environment variables. This creates a trust boundary issue: if the MediaCrawler checkout is malicious, compromised, or replaced via MEDIA_CRAWLER_PATH, the skill will run arbitrary code under the user's privileges.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("Starting XHS crawler (CDP mode)...") print("If login required, scan QR code on your phone.") result = subprocess.run( [str(venv_python), "main.py", "--platform", "xhs", "--lt", "qrcode"], cwd=str(crawler_path), env=env,
Static analysis
No suspicious patterns detected.