Security audit

收藏雅集网-古董鉴定估价

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real antique-appraisal workflow, but it handles phone/SMS login, payments, uploaded item photos, and reusable tokens with weak disclosure and token protection.

Review before installing. Use the skill only if you are comfortable sending item photos, descriptions, phone/SMS login data, and order/payment information to the stated service. Avoid passing real tokens on the command line, delete ~/.jianding_token after use, and verify pricing, AI/free-service claims, refund terms, and privacy terms directly on the service before paying.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document gives conflicting statements about whether AI appraisal is available as a free standalone user-facing service. Some entries say users can choose a free AI鉴宝 option, while later entries say AI cannot be used independently and is only a backend assistant. In a commerce flow involving payments and service selection, this can mislead users, cause wrongful charges, and increase dispute risk.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file contradicts itself on free appraisal/估价 availability: some rows imply appraisal is included only for certain paid expert results, while others say authentic items receive free valuation. These inconsistencies can manipulate user expectations around paid upgrades and create deceptive service terms in a transactional setting.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases include broad everyday language such as “帮我看看” and “值多少钱,” which can cause the skill to activate in contexts unrelated to appraisal orders. Overbroad invocation can lead the agent to solicit photos, phone numbers, or route users into an external commercial workflow without clear intent, creating privacy and consent risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs collection of sensitive user data including phone numbers, item photos, SMS codes, and local token storage, but does not present an explicit privacy notice, retention policy, or local-storage warning before doing so. Because the workflow also submits this data to a third-party service and persists authentication material on disk, users may unknowingly expose personal and potentially valuable-asset information.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill states that overseas users must translate descriptions into Chinese and pay only in RMB, without offering language choice or informed opt-in. This is not a classic security flaw, but it is a risky quality/compliance issue because it can exclude users, increase misunderstanding in a paid workflow, and lead to inaccurate submissions or payment errors.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persists the bearer token in ~/.jianding_token without setting restrictive file permissions or clearly warning the user that a reusable credential is being stored locally. On multi-user systems or misconfigured environments, another local process or user may read the token and access the victim's account functions, including order history and payment-related actions.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:519