Noon 商品搜索工具

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  1.0.0

Overview

This Noon product search skill appears to scrape product listings, but it uses under-disclosed stealth browser automation and broader browsing behavior than its description promises.

Review this before installing. Run it only in a clean browser profile with no logged-in accounts, avoid leaving Chrome remote debugging enabled, and pin or inspect the Node dependencies yourself. Treat the output scope as broader than first-page search results unless the implementation is changed to match the documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The use of a stealth evasion plugin introduces unnecessary anti-detection behavior for a simple product search tool, which expands the skill's capability beyond its stated purpose. In this context, stealth makes the automation harder to distinguish from normal browsing and can facilitate scraping in ways that bypass site defenses or operator review, increasing abuse potential.

VirusTotal

64/64 vendors flagged this skill as clean.