Security audit

小鹿选房

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it directs the agent to run an unpinned npm real-estate CLI that can handle API keys and local configuration, though the artifacts do not show clearly malicious behavior.

Review before installing. Only use this skill if you trust the xiaolu-house npm package and publisher, prefer a pinned reviewed version, use a limited API key, and require confirmation before showing or clearing saved configuration.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:45
Finding: Mandatory Commercial Output and External Redirection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:39
Finding: Automatic Execution of an Unpinned Third-Party npm Package
Content: View full analysis
[arguments] ``` Related commands and instructions include: ```bash npx -y xiaolu-house --help npx -y xiaolu-house cities npx -y xiaolu-house config --show npx -y xiaolu-house config --set-api-key npx -y xiaolu-house config --set-city npx -y xiaolu-house config --clear ``` The Skill also instructs the Agent to execute all `npx -y xiaolu-house` commands on the user's behalf and to invoke the help command before queries. ### Technical Analysis The command uses `npx -y` without an exact package version. If the package is not already available in a trusted local cache, `npx` may retrieve the current package release and execute it automatically. The `-y` option suppresses the normal installation confirmation. The audited project contains only `SKILL.md`. It does not include the npm package source, a lockfile, a package integrity hash, a signature, or other material that would allow the remotely supplied implementation to be reviewed as part of this audit. Consequently, the code executed at runtime can differ from the code that existed when the Skill documentation was reviewed. A compromised npm publisher account, malicious package update, registry compromise, or other supply-chain event could therefore cause arbitrary package code to execute under the identity running the Agent. The Skill also passes an API key to the external CLI and states that configuration is stored under `~/.xiaolu-house/config`. The documentation claims that the key is encrypted, but the implementation is absent, so its storage and network handling cannot be verified. ### Attack Path 1. A user invokes the Skill for a property-related request. 2. The Skill instructs the Agent to run `npx ...[truncated 1413 chars]
Remediation: View remediation
[arguments] ``` 2. Verify the selected release and all transitive dependencies before deployment. 3. Record and verify package integrity hashes or cryptographic signatures. 4. Include a lockfile and reviewed package source in the audited distribution where practical. 5. Avoid automatic `-y` installation during user requests. Install approved dependencies during a controlled deployment phase instead. 6. Disable or carefully review npm lifecycle scripts. 7. Execute the CLI in a sandbox with minimal filesystem access, restricted environment variables, no unnecessary subprocess privileges, and narrowly scoped network access. 8. Use a dedicated credential with the minimum required API permissions. 9. Do not place API keys directly in command-line arguments because process listings and shell history may expose them. Prefer protected standard input, an operating-system credential store, or a restricted file descriptor. 10. Independently verify the claimed encryption and permissions of `~/.xiaolu-house/config`. 11. Define an allowlist of permitted CLI subcommands and validate all user-derived arguments before execution. 12. Re-audit every package update before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill instructs execution of npx -y xiaolu-house without pinning a specific package version, which causes runtime retrieval of the latest published package. If the npm package is updated maliciously, hijacked, or a compromised dependency is introduced, users may execute attacker-controlled code when invoking the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill instructions and example user-facing messaging are entirely in Chinese and direct the agent to execute commands and reply in natural language without indicating that the user can choose another language. This can constitute a language/locale policy issue because it imposes a specific language without documented opt-in or explicit regional justification in the instructions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The activation guidance includes broad triggers such as generic home-search requests, which can cause the skill to be invoked when the user's intent is still ambiguous. In an agentic setting this increases the chance of unnecessary external command execution, unintended data access, or premature collection of city/API-key information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This invocation pattern relies on an unpinned npm package at runtime, so the executed code can change without any change to the skill file itself. That creates a supply-chain execution risk because an attacker who gains control of the package or its release pipeline can deliver arbitrary code to skill users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill explicitly tells the agent to execute all npx -y xiaolu-house commands on the user's behalf, magnifying the risk of unpinned remote code execution. Because the package is not version-locked, the trust boundary extends to the current state of the npm registry and publisher account at execution time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The documented generic CLI form npx -y xiaolu-house <命令> [参数] is unpinned, so every supported operation may fetch and run new code from the registry. In a skill context where the agent is expected to execute commands automatically, this meaningfully increases exploitability of a package compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The instruction to run npx -y xiaolu-house --help without a version pin still executes package code obtained at runtime. Even a seemingly harmless help command can trigger install scripts or malicious package behavior if the package supply chain is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The cities command is presented through an unpinned npx invocation, so a user asking only for supported cities still triggers execution of mutable remote code. The risk is contextualized by the skill's expectation that the agent will run these commands directly for users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises config --show to display current configuration and user information without a clear warning or consent checkpoint. This can expose locally stored personal or account data to the conversation or logs when users did not explicitly ask to reveal it.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The config --show example uses an unpinned package and also accesses stored configuration and user information, combining supply-chain execution risk with exposure of potentially sensitive local data. If the package is compromised, it could exfiltrate configuration contents rather than merely display them.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The API key configuration command executes an unpinned npm package, which is especially dangerous because it handles credentials. A compromised package could steal the provided API key or alter how it is stored.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The default-city configuration command still inherits the same unpinned runtime package risk as other invocations. Although this specific action is lower sensitivity than API-key handling, it remains arbitrary-code execution from an uncontrolled latest package version.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill documents config --clear without warning users that persisted configuration and credentials may be removed. This can lead to accidental destructive actions, service disruption, or forced reconfiguration if the command is triggered without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The config --clear example uses an unpinned package, so a destructive or privileged action is delegated to code fetched at execution time. In the event of package compromise, the action performed could exceed clearing configuration and become arbitrary local manipulation.
Content: No source excerpt is available for this finding.