Steam Lowest Price Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This Steam price watcher is not destructive, but its advertised historical-low alerts do not match what the code actually checks.

Review this before installing if you need accurate historical-low tracking: it currently checks China-region Steam prices in CNY, stores a local watchlist/state, and may alert on any discount rather than a true historical low. Treat it as a discount notifier unless the author fixes or documents the alert semantics and locale clearly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior does not match the actual behavior: it may alert on any discount, use a locally observed low instead of a true historical low, and rely on CheapShark for resolution while presenting itself as Steam-focused monitoring. This is dangerous because users and orchestrators may make trust or execution decisions based on inaccurate claims, leading to deceptive outputs, unexpected network use, and incorrect financial decisions or spammy alerting.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill exposes implied file read, file write, and network behavior without declaring any tool scope or permissions in the manifest. This creates a transparency and least-privilege problem: an agent or reviewer cannot easily determine what capabilities the skill needs, increasing the risk of overbroad execution and unintended data access or external communication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation guidance says to use the skill when users ask to "track Steam discounts" or "watch specific games," but it does not define exact trigger phrases, boundaries, or exclusion conditions. This ambiguity could cause unintended invocation for general Steam-related conversations rather than explicit price-monitoring requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code hard-codes Steam pricing requests to China (cc=cn) and Simplified Chinese (l=schinese). This enforces a specific locale regardless of user preference and matches the policy category for language/locale constraints without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill alerts when a game hits a historical low or a user target price. In cmd_check, the code explicitly triggers an alert whenever discount_percent > 0, even if the current price is above the observed low, so the implemented alerting behavior is broader than the stated purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The comment documents the rule as 'as long as it is discounted, trigger an alert,' which conflicts with the manifest's stated behavior of alerting on historical lows or target price hits. This is an active intent-level contradiction between code documentation and the skill's declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents the title and manifest description in English while most operational instructions and output text are in Chinese, including the suggested user-facing reply. This creates an implicit language policy without opt-in and may force responses in a specific language for users who did not request it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any future major or minor release to be installed. This undermines reproducibility and can unexpectedly introduce vulnerable or breaking versions through the supply chain, especially in automated builds or redeployments.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Because requests is not pinned, it is impossible to verify whether the installed version includes fixes for known advisories affecting older releases. In a network-facing skill that monitors prices and likely performs HTTP requests, an affected version could expose credentials, mishandle TLS or redirects, or otherwise weaken request security depending on runtime behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.