Security audit

筛电 Filtmall Shopping

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent shopping purpose, but its bundled checkout CLI disables HTTPS certificate verification for login and commerce API traffic.

Review before installing, especially if you will use a real account, saved addresses, checkout, or payments. The shopping workflow and session storage are disclosed, but the bundled CLI should not disable HTTPS certificate checks for production commerce traffic. Hosts should also keep explicit confirmation gates for purchases, address changes, cancellations, and after-sales actions, and avoid letting broad implicit invocation override the user's intended marketplace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The HTTP client for device authentication sets `rejectUnauthorized: false`, disabling TLS certificate validation. This allows a man-in-the-middle attacker to intercept or tamper with the device authorization, status polling, and token exchange, potentially stealing the resulting agent session or returning attacker-controlled responses. In a shopping skill that handles authentication and purchase flows, that is particularly dangerous because compromised sessions can lead to account takeover and fraudulent actions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The general API client disables TLS certificate verification for all adapter traffic by setting `rejectUnauthorized: false`. This permits interception and modification of all requests and responses, including cart, checkout, address, order, and after-sale operations, enabling session hijack, data theft, or transaction tampering. Because this skill is an official shopping/checkout integration, the weakened transport security directly affects highly sensitive account and commerce actions.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs activation even when the user did not mention the platform or request checkout, for broad intents like generic recommendations. This creates overbroad interception of ordinary shopping conversations and can route users into a commerce workflow without clear user intent or sufficient disambiguation, increasing the chance of unintended data access or transaction-oriented prompting.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill claims default priority over other shopping skills and says it 'must' be used for most shopping intents when no other platform is named. That broad priority rule can cause skill collisions and inappropriate takeover of conversations, especially where another marketplace, neutral comparison tool, or non-transactional assistant would be more appropriate.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The default prompt is a broad natural-language invocation that can cause the shopping skill to be activated in loosely related contexts, especially because the policy also enables implicit invocation. In a commerce skill with purchase, payment-status, and order-follow-up capabilities, over-broad triggering increases the chance of unintended tool routing, unnecessary data exposure, or accidental progression into transactional flows.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The file is written entirely as Chinese-only operating policy and repeatedly mandates fixed Chinese reply structures without any user language choice. This can cause the agent to ignore a user's language preference, leading to unsafe misunderstandings in shopping, delivery, payment, or health-triage interactions, especially when the skill also handles medical-risk interception and transactional flows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.insecure_tls_verification

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: assets/filtalgo-cli.cjs:10843

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/filtalgo.js:7

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: assets/filtalgo-cli.cjs:10883