JD商品评价

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.0

Overview

This skill openly automates posting bulk five-star JD reviews from a logged-in real account, but it lacks clear confirmation controls and auto-installs unpinned third-party tooling.

Review carefully before installing. This skill can post many public five-star reviews from your real JD account using preset text, and those posts may be hard to undo or violate platform expectations. Only use it with explicit review, confirmation, and trusted dependency setup in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/jd_review.py:24

Finding

Automatic Installation and Execution of an Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/jd_review.py:24-32
Vulnerability Type: Unpinned dependency installation and immediate execution
Risk Level: Medium

Vulnerable Code

python

try:
    subprocess.run(
        [sys.executable, "-m", "pip", "install", "browser-use"],
        check=True, capture_output=True, text=True
    )
    subprocess.run(
        ["browser-use", "install"],
        check=True, capture_output=True, text=True, timeout=120
    )

The same unsafe installation process is also documented in SKILL.md:21-22 and conditionally invoked in SKILL.md:35:

bash

pip install browser-use
browser-use install

bash

which browser-use || pip install browser-use && browser-use install

Technical Analysis

The Skill installs browser-use from the configured Python package index without specifying an audited version or verifying an integrity hash. It then immediately executes the newly installed browser-use command with the install subcommand.

Because neither the direct package nor its transitive dependency graph is locked, the effective code executed by the Skill can change after the Skill itself has been audited. This creates a supply-chain trust boundary in which a compromised package release, dependency, package repository, or local package-index configuration could introduce arbitrary code.

The use of an argument list in subprocess.run prevents shell metacharacter injection at this location, but it does not mitigate dependency substitution or upstream package compromise.

Attack Path

1. An attacker compromises a future browser-use release, one of its transitive dependencies, or a package source configured in the user's Python environment.
2. The user invokes the Skill on a system where browser-use is unavailable.
3. ensure_browser_use() runs pip install browser-use, resolving and installing the current unpinned package and dependency versions.
4. The script immediately invokes `brow ...[truncated 1121 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from the operational script. Fail safely with clear manual setup instructions when the dependency is unavailable.
2. Pin browser-use to a specifically reviewed version rather than resolving the latest release.
3. Lock all transitive dependencies and require cryptographic hashes, for example through a generated requirements lock file installed with pip --require-hashes.
4. Install dependencies in a dedicated virtual environment with no unnecessary access to unrelated project or user resources.
5. Treat browser-use install as a separate, security-sensitive installation step. Require explicit user approval and document what binaries, system packages, and network sources it uses.
6. Verify downloaded browser artifacts using trusted checksums or signatures where supported.
7. Use a trusted package index and explicitly control index configuration to reduce dependency-substitution risks.
8. Add dependency vulnerability and provenance checks to the release process, and repeat the audit whenever the pinned package or lock file changes.
9. Update SKILL.md:21-22 and SKILL.md:35 so the documentation no longer instructs the agent to install and immediately execute an unpinned package.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger condition is so broad that nearly any request involving JD product reviews will activate a workflow that logs in, navigates user pages, and submits reviews in bulk. Because review submission is an external side-effecting action on a real account, overbroad triggering materially raises the risk of accidental activation and unauthorized mass posting.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script performs bulk posting of reviews and clicks the final submission action for all collected items without a confirmation gate, dry-run mode, or per-item approval. In context, this is especially risky because product reviews are public, user-attributed, and effectively irreversible, so accidental execution can cause account misuse, policy violations, reputational harm, and fraudulent-looking activity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill invokes shell commands such as pip installation, browser automation setup, and direct execution of a local Python script, but declares no tool restrictions or permission boundaries. In an agent environment, this creates unnecessary command-execution capability and increases the chance of unintended package installation, local script execution, or misuse of the host environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill automates bulk submission of public product reviews but does not clearly warn the user about the risks of irreversible account actions, platform policy violations, or reputational consequences. Without a clear risk prompt, users may unknowingly authorize high-impact actions on their logged-in account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill forces prewritten positive Chinese review templates and provides no mechanism for user choice, review customization, or confirmation per item. This can cause deceptive or inaccurate statements to be posted automatically, amplifying the impact through bulk submission and creating account, policy, and trust risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file’s user-facing description and runtime messages are entirely in Chinese, and the automation logic depends on matching Chinese UI text such as '评价' and '发表'. This imposes a specific language/locale without opt-in or explanation, which matches the policy concern for forced language constraints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill both installs and executes third-party software even though its core purpose is automating JD reviews, so it introduces host-level code execution and supply-chain exposure unrelated to the narrow user task. Because the content is an automation skill, not a package-management tool, this broader capability makes the skill materially more dangerous in context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The script automatically installs external software at runtime with pip, which expands the trust boundary and executes code from the Python package supply chain without explicit user approval. In a skill whose purpose is JD review automation, silent dependency installation is risky because a compromised package, typo-squatted dependency, or unexpected install hook could lead to arbitrary code execution on the host.

Content

Scanner excerpt · scripts/jd_review.py (reported line 28)May include surrounding context.

python

print("未检测到 browser-use，正在自动安装...")
    try:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "browser-use"],
            check=True, capture_output=True, text=True
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

After installation, the script immediately executes the newly installed browser-use CLI installer, which compounds supply-chain risk by running external setup logic on the local system. This creates an unnecessary code-execution path beyond the stated business action of posting reviews and could alter the host environment, browser configuration, or additional binaries without clear user consent.

Content

Scanner excerpt · scripts/jd_review.py (reported line 32)May include surrounding context.

python

[sys.executable, "-m", "pip", "install", "browser-use"],
            check=True, capture_output=True, text=True
        )
        subprocess.run(
            ["browser-use", "install"],
            check=True, capture_output=True, text=True, timeout=120
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/jd_review.py (reported line 66)May include surrounding context.

python

def run(cmd_args, timeout=20):
    """执行 browser-use CLI 命令"""
    args = ["browser-use", "--browser", "real", "--headed", "--session", "jdreview"] + cmd_args
    r = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
    return r.stdout.strip()