Security audit

极鲸云速卖通商品搜索

Security checks for vulnerabilities and agentic risk

Overview

This AliExpress research skill appears purpose-built rather than malicious, but it needs Review because it stores GeekBI login tokens in multiple local places and allows unvalidated authentication destinations.

Review before installing in environments with sensitive workspaces. Only use it if you are comfortable authenticating to GeekBI and storing session tokens on disk; avoid custom --base-url values, verify login links before opening them, and prefer a version that stores credentials in one protected user-specific location with an HTTPS allowlist for GeekBI origins.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/geekbi_auth.py:69
Finding: Bearer tokens are unnecessarily replicated across multiple storage locations
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/geekbi_auth.py:698
Finding: Unrestricted API base URL permits authentication over untrusted or plaintext origins
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/geekbi_auth.py:498
Finding: Server-controlled action URLs are exposed to users without origin validation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Dependency resolution is not reproducibly pinned or hash-verified
Content: View full analysis
=4.0,<5.0 ``` ### Technical Analysis The dependency specification permits any `platformdirs` release from version 4.0 up to, but excluding, version 5.0. It does not identify one audited version and does not include a package hash. As a result, two installations performed at different times may execute different third-party code even though the Skill source has not changed. A future compromised, defective, or behaviorally incompatible release within the accepted range could be selected automatically. No evidence was found that `platformdirs` is malicious, misspelled, or obtained from an explicitly unsafe index. The finding is therefore a dependency-hardening and reproducibility weakness rather than evidence of an intentionally malicious dependency. ### Attack Path 1. A new package version satisfying `>=4.0,<5.0` is published. 2. The installation process resolves that version instead of the version originally reviewed. 3. The package is installed without hash verification. 4. Its code executes when `geekbi_auth.py` imports and calls `platformdirs.user_config_path()`. 5. If that allowed release is compromised, malicious package code executes with the permissions of the user running the Skill. ### Impact Assessment A compromised dependency executes in the Skill process and therefore inherits the process’s filesystem and network permissions. It could potentially read the authentication state handled by `geekbi_auth.py` or alter configuration-path behavior. The finding does not demonstrate an existing compromise. Its confirmed impact is reduced build reproducibility and an avoidable increase in supply-chain exposure. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose omits materially sensitive behavior: local persistence of authentication state, login/device-code flows, token handling, automatic authenticated requests, and auth-state management commands. Undisclosed credential storage and auth automation are security-relevant because they can expose tokens, create unexpected persistence on disk, and expand the blast radius if the skill or host environment is compromised.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose omits materially sensitive behavior: local persistence of authentication state, login/device-code flows, token handling, automatic authenticated requests, and auth-state management commands. Undisclosed credential storage and auth automation are security-relevant because they can expose tokens, create unexpected persistence on disk, and expand the blast radius if the skill or host environment is compromised.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises executable/scripted behavior (scripts/aliexpress_site_list.py, aliexpress_goods_search.py, aliexpress_goods_info.py) but does not declare any explicit tool scope or permission boundaries. That makes the effective access to file, shell, and network capabilities opaque to reviewers and increases the risk of overprivileged execution or unexpected side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description says to use the skill whenever the user mentions topics like AliExpress product search, hot products, new products, ranking lists, price bands, growth trends, candidate filtering, or single-product research. This trigger language is broad and lacks explicit boundaries or negative examples, which could cause the skill to activate for general discussion or analysis requests that are not intended to invoke this specific capability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction '原样使用服务端中文 msg' requires the skill to present Chinese content as-is, which enforces a specific language on the user without any opt-in or alternative. This is a natural-language policy concern because the file does not indicate the skill is region-specific or that users can choose their preferred language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This Python file contains natural-language strings entirely in Chinese, including the module description and multiple exception messages shown to users. Under the policy, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is explicitly justified, which is not present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code's natural-language interface is entirely Chinese, including the module docstring, CLI argument descriptions, and error messages. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This Python file contains its top-level docstring entirely in Chinese, and the rest of the script consistently uses Chinese-only user-facing strings for errors, prompts, and CLI descriptions. Under the language/locale policy rule, forcing a specific language without user choice is a natural-language policy violation unless clearly documented as region-specific, which is not evident in this file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The auth state is stored under a different namespace (temu-research-skill) than the declared AliExpress skill, creating unintended state sharing and confusion between skills. If another skill or workflow uses the same storage path, tokens or pending login state can be reused, overwritten, or cleared across unrelated skills, causing cross-skill credential mix-up and possible unauthorized API access within the same local user context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code presents its primary natural-language interface in Chinese only, including the module docstring and command description. The policy for natural-language violations applies to all file types, and there is no visible user choice or opt-in for language/locale in this file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring claims 'Bearer request wrapping', which ordinarily means using the HTTP Authorization: Bearer ... header. However, the implementation places the returned bearer string into a custom token header instead, so the documentation actively misstates how authentication is performed.
Content: No source excerpt is available for this finding.