T09 · Insecure Skill Coding Practices
Error
- Location
scripts/aliexpress_goods_search.py:56- Finding
Unrestricted API Origin Enables Arbitrary Network Requests and Untrusted Authentication Links
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云速卖通数据分析与市场调研
Security checks for vulnerabilities and agentic risk
Overview
The skill’s AliExpress research purpose is mostly coherent, but its authentication flow and local token handling are broader and less disclosed than a user would expect.
Install only if you trust GeekBI and are comfortable with the skill storing API login state locally. Avoid using custom --base-url values, verify any login link before opening it, and clear .geekbi or GeekBI auth state after use on shared, synced, or support-bundled workspaces.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:365- Finding
Bearer Tokens Are Replicated Across Multiple Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is passive market-data research, but the detected behavior includes local persistence of login/token state, authorization flow management, automatic credential attachment, storage probing, and state-clearing functions. This mismatch is dangerous because users and orchestrators may grant trust based on a narrow read-only description while the skill actually handles authentication material and local state, increasing the risk of credential exposure, unintended auth reuse, or abuse of persisted tokens.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable capabilities such as file access, network use, and shell-script invocation but does not declare any explicit tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and can allow broader-than-expected execution paths if the skill is invoked or extended in ways the user did not anticipate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger language is broad enough to match many ordinary requests about AliExpress, product research, trends, sellers, or market analysis. Over-broad activation can route unrelated conversations into a skill with network, file, and shell-backed capabilities, increasing the chance of unintended execution and unnecessary data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The display name, short description, and default prompt are all written exclusively in Chinese, which indicates the skill is oriented to a single language with no visible option for users to choose another locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language strings that enforce a single locale for documentation and validation feedback. Under the policy, forcing a specific language without offering choice or clearly documenting a justified locale constraint is a reportable language-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The exceptions raised throughout the parsing and validation helpers use Chinese-only text, which means users receive runtime feedback in a fixed language without opt-in. This is a natural-language policy concern because the file does not offer a language/locale choice or document a justified regional limitation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The auth state path is created under "temu-research-skill" even though this skill is for AliExpress research. This namespace mismatch can cause credential/state confusion across skills, including accidental reuse, overwrite, or clearing of another skill's login state if both interact with the same backend or run in the same environment. In an auth module, cross-skill state collisions are security-relevant because they can mix identities or expose one skill's session material to another component unexpectedly.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README is entirely written in Chinese and does not indicate that users may interact in other languages or choose a preferred locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction '默认使用简体中文' imposes a language default that may conflict with organizational language/locale policies when the user has not requested Chinese. There is no stated opt-in, fallback, or user language choice in the document.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code presents its user-facing natural-language strings entirely in Chinese, including the module description, argument help text, and validation messages. Under the stated policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.
- Content