Security audit

Product Recommender

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent retail product-recommendation skill with some recommendation-quality issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Install only if you want a Chinese-oriented retail recommender and are comfortable with soft budget handling. Review or adjust the fallback logic if strict budget, allergy, material, safety, or other hard constraints must never be relaxed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 55% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
### "再便宜一点" (Price objection) When customer asks for cheaper options after seeing recommendations: - Re-filter with lower budget - If nothing cheaper: explain value at current price, don't apologize for price ### "没有我想要的" (No match) When no product passes the filters:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill references local files such as references/intent-extraction.md, references/filtering-logic.md, and scripts/recommend.py, which implies file-read capability, but it does not declare any explicit tool scope or permissions boundary. Undeclared capabilities make review and runtime enforcement harder and can lead to broader-than-expected data access if the platform grants default file access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is very broad, including generic phrases like recommend, best for, help me pick, and I'm looking for, which can cause the skill to activate in many unrelated conversations. Over-broad activation can hijack routing, suppress more appropriate skills, and increase the chance of irrelevant recommendations or unintended use of customer context such as purchase history.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The overview states that the skill handles all help me choose queries, which is an ambiguous and expansive activation condition. In a multi-skill environment, this can cause accidental invocation for decisions unrelated to retail products, creating routing errors and exposing the user to recommendations outside the intended scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The recommendation presentation templates and example output are written only in Chinese, and the skill does not state that language should match the user's preference or provide an opt-in choice. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without user selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The no-results flow includes a hardcoded Chinese user-facing message, which can force output in a language the user did not request. In a product recommendation skill, this creates a quality, accessibility, and trust issue because users may misunderstand pricing or recommendation caveats, especially when the message explains that an item exceeds budget.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The clarification prompts are written as fixed Chinese responses, and the examples throughout the guide assume Chinese-only user interaction. There is no indication that the skill supports language choice or that the Chinese-only behavior is an explicitly documented regional constraint, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code generates recommendation reasons entirely in Chinese string literals, and the example usage also uses Chinese preference values. That enforces a specific language/locale in user-facing output without offering opt-in, fallback, or documenting that the skill is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: If filtering yields no matches, the code falls back to products[:10], explicitly ignoring both budget and user constraints while still returning recommendations. In a retail recommendation skill, this can mislead users into being shown unsuitable, unaffordable, or policy-incompatible products despite the interface implying those requirements were applied.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code automatically increases budget_max by 20% when no items match, which overrides an explicit user limit without confirmation. In a product recommender, this can steer users toward more expensive products than requested and undermines trust in the assistant's adherence to user-defined constraints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.