Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Filtmall shopping skill with expected account use and buyer-confirmed shopping actions.
Before installing, understand that this skill can sign in to Filtmall, read order/address data, create checkout/payment links, and perform confirmed cart/order/after-sales actions. Use it only if you trust Filtmall with that shopping account context, and review payment or account changes before confirming them.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
npm-debug.log*
yarn-debug.log*
yarn-error.log*
.env
.env.*
credentials.json
config.local.yaml
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
yarn-error.log*
.env
.env.*
credentials.json
config.local.yaml
test-results/
The declared behavior promises shopping, account, payment, logistics, refund, and ingredient-query workflows, but the detected implementation does not provide those functions and instead performs URL-validation and SSRF-style host checks. This mismatch is dangerous because reviewers and orchestrators may trust the skill with sensitive commerce/account contexts under false assumptions, while hidden or unrelated network-handling logic can mask data-routing behavior or create a deceptive interface for future abuse.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const path = require('path');
const { getConfigDir } = require('./config');
const CREDENTIALS_FILE = path.join(getConfigDir(), 'credentials.json');
const PENDING_AUTH_FILE = path.join(getConfigDir(), 'pending-auth.json');
function save(credentials) {
The README instructs users to install via npx skills add ... without pinning the skills package or otherwise constraining the exact tool version that will be fetched and executed. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users following the documentation may execute unreviewed code during installation.
The installation command uses npx skills add ... without pinning the skills package to a specific version. Because npx may fetch the latest published package at execution time, a malicious or compromised upstream release could execute arbitrary code on the installer’s machine during setup. In a skill README, this is especially relevant because users are likely to copy-paste the command directly.
The skill declares broad operational behavior but does not restrict tool scope even though code capabilities indicate access to environment, MCP, and network surfaces. In an agent setting, missing explicit tool/permission boundaries can let the skill invoke more powerful capabilities than users or reviewers expect, increasing the blast radius of prompt abuse, data exposure, or unintended external access.
The instruction mandates a fixed Chinese footer string whenever the user's current language is Chinese, rather than offering a language or locale choice. This is a natural-language locale policy constraint embedded in the skill instructions and applies automatically based on language detection rather than explicit user opt-in.
The default prompt states 'give safety guidance in the user's current language,' which imposes a language behavior in natural-language instructions. The file does not indicate user choice, opt-in, or a documented region-specific justification for this locale constraint.
This asset includes substantial medical and pharmaceutical marketing content, including claims about drugs, whitening efficacy, expert consensus, GMP facilities, and therapeutic heritage, while the skill is described as a shopping and cosmetic-ingredient tool rather than a regulated medical advisory surface. In this context, such content can steer product recommendations with health-adjacent or therapeutic claims and increase the chance the agent presents promotional medical information as trustworthy decision support.
This code defines multiple CLI error messages entirely in Chinese, which means users receiving these messages are forced into a specific language experience. The file does not provide any apparent locale selection, fallback, or opt-in mechanism for alternate languages.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
}
try {
const tools = await api.mcpList();
const count = tools && Array.isArray(tools.tools) ? tools.tools.length : 0;
addCheck(checks, 'adapter_tools', count > 0, `${count} tools`);
} catch (err) {
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
}
try {
const tools = await api.mcpList();
const count = tools && Array.isArray(tools.tools) ? tools.tools.length : 0;
addCheck(checks, 'adapter_tools', count > 0, `${count} tools`);
} catch (err) {
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
}
try {
const tools = await api.mcpList();
const count = tools && Array.isArray(tools.tools) ? tools.tools.length : 0;
addCheck(checks, 'adapter_tools', count > 0, `${count} tools`);
} catch (err) {
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
}
try {
const tools = await api.mcpList();
const count = tools && Array.isArray(tools.tools) ? tools.tools.length : 0;
addCheck(checks, 'adapter_tools', count > 0, `${count} tools`);
} catch (err) {
The skill mandates a fixed Chinese reply for a medical-safety branch and elsewhere strongly constrains exact output, without checking the user’s preferred language. This can create a safety and usability failure: users who do not read Chinese may miss urgent guidance or be unable to make informed purchasing decisions, especially in health-adjacent scenarios.
This file contains user-facing messages in Chinese, such as error text and command instructions, without any indication that the user can select a language or that the skill is intentionally limited to a Chinese-speaking locale. That creates a natural-language policy issue if users are not explicitly opted into this locale.
This code persists search and recommendation state to JSON files under the system temporary directory, which may contain user shopping queries or profile-derived context. There is no confirmation prompt, user-facing log/print statement, or inline warning disclosing that user-related data is being written to disk.
The locale function only permits 'en-US' and defaults every other input to 'zh-CN'. This imposes a language choice on users who request any other locale and does not offer opt-in or fallback behavior aligned with the user's requested language.
This code hardcodes user-facing text in Chinese, beginning with the price disclaimer, and the rest of the response templates throughout the file are also fixed to Chinese. The file does not offer any user opt-in, locale selection, or documented justification that the skill is intentionally limited to a Chinese-only region or audience.
The code rejects any request_profile.locale other than zh-CN or en-US, which imposes a language/locale restriction in natural-language-facing behavior. There is no indication here that users are offered broader locale choice or that this limitation is justified as a region-specific requirement.
The skill defines user-visible messages only for Chinese and US English, and combined with the locale fallback logic this means unsupported locales are forced into one of those languages. That constitutes a locale-policy issue unless the limitation is explicitly justified or optional for the user.
The locale selection logic returns 'zh-CN' for every request except those explicitly marked 'en-US'. This imposes a specific language by default rather than offering a user choice or honoring other locales, which is a natural-language policy concern.
The file hardcodes Chinese user-facing text throughout, including the tail note, response headings, table labels, and the instruction string that dictates the final reply format. This imposes a specific language on all users without offering a language selection or documenting a justified locale restriction.
This file is plain text, so only SQP-3 applies. The license prominently uses Chinese-language organization and brand text alongside English, but does not state that the document is intentionally bilingual or provide any user choice about locale; this can be read as a mild language/locale policy concern in natural-language content.
Detected: suspicious.dangerous_exec