极鲸云速卖通店铺搜索

• Outcome: Review
• Latest audit: Sep 7, 2026 · 8:13 AM UTC
• Version: 0.1.0

Overview

The skill is a read-only AliExpress research tool, but it under-discloses and overextends local authentication handling for GeekBI access tokens.

Review this skill before installing if you are uncomfortable with GeekBI login state being stored locally. Use it only with the default GeekBI endpoint, avoid running it from shared or synced workspaces, and clear the auth state when finished if the token should not remain on disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/geekbi_auth.py:66
• Finding: Bearer Token Replicated Across Multiple Local Storage Locations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:66-89`, `scripts/geekbi_auth.py:637-649` **Vulnerability Type**: Excessive plaintext credential storage **Risk Level**: Medium ### Complete Code Snippet ```python def _user_config_state_path(): return _absolute_path( user_config_path("GeekBI", appauthor=False, ensure_exists=True) / "temu-research-skill" / AUTH_FILE_NAME ) def _skill_state_path(): return _absolute_path(Path(__file__).parent.parent / AUTH_STATE_DIR / AUTH_FILE_NAME) def _workspace_state_path(): return _absolute_path(Path(os.getcwd()) / AUTH_STATE_DIR / AUTH_FILE_NAME) def _resolve_stores(): candidates = ( ResolvedStore(_user_config_state_path(), "user-config-directory"), ResolvedStore(_skill_state_path(), "skill-directory"), ResolvedStore(_workspace_state_path(), "working-directory"), ) ``` The returned access token is subsequently placed in the state that is written to these stores: ```python def save_token(latest): latest_server = latest["servers"].get(server_key) if not isinstance(latest_server, dict): return False, False latest_pending = latest_server.get("pending") if not isinstance(latest_pending, dict): return False, False if latest_pending.get("deviceCode") != pending.get("deviceCode"): return False, False _remove_access_token(latest_server) latest_server["accessToken"] = access_token latest_server["accessTokenExpiresAt"] = now + max(0, expires_in - 30) latest_server.pop("pending", None) return True, True ``` ### Technical Analysis The authentication state, including a bearer access token, is mirrored to three locations: 1. A user configuration directory. 2. The installed Skill directory. 3. A `.geekbi` directory under the current working directory. Only one protected credential location is required for the declared AliExpress research functionality. Replication i ...[truncated 1999 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Persist authentication state in only one dedicated user credential location. 2. Remove the Skill-directory and current-working-directory stores. 3. Prefer an operating-system credential manager or secret-storage API instead of a plaintext JSON file. 4. Replace the unrelated `temu-research-skill` namespace with an AliExpress-specific application namespace. 5. Add a migration that: - Reads existing legacy state once. - Moves it to the protected canonical location. - Securely removes obsolete copies where feasible. 6. Preserve restrictive file permissions and fail closed if they cannot be established. 7. Store only the minimum required token fields and avoid persisting device codes or navigation URLs longer than necessary. 8. Document token lifetime, revocation behavior, storage location, and cleanup procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/aliexpress_goods_search.py:54
• Finding: Unrestricted Base URL Permits Authentication Against Untrusted or Cleartext Origins<![CDATA[ ## Vulnerability Details **File Location**: `scripts/aliexpress_goods_search.py:54-63`, `scripts/aliexpress_mall_info.py:25-33`, `scripts/aliexpress_site_list.py:61-69`, `scripts/geekbi_auth.py:578-579`, `scripts/geekbi_auth.py:698-721` **Vulnerability Type**: Missing service-origin validation **Risk Level**: Medium ### Complete Code Snippet All query entry points expose an unrestricted base URL. For example: ```python def main(): parser = argparse.ArgumentParser(description="查询 AliExpress 商品并输出 JSON") parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="查询条件，格式为 名称=值") parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` The authentication endpoint is constructed directly from that value: ```python endpoint = f"{base_url.rstrip('/')}{TOKEN_ENDPOINT}" try: response = _post_json(endpoint, {"deviceCode": pending["deviceCode"]}, timeout) ``` Authenticated requests also use the supplied URLs without validating their scheme or host: ```python def authenticated_json_request( url, base_url, timeout, *, method="GET", body=None, headers=None, ): complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) _raise_action_if_needed(response_payload) ...[truncated 2588 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--base-url` from production entry points and use the fixed official endpoint. 2. If endpoint customization is operationally required, parse the URL and enforce an explicit allowlist such as: - Scheme: `https` - Host: `openapi.geekbi.com` - Port: `443` or no explicit port 3. Reject URLs containing user information, fragments, unexpected ports, non-HTTPS schemes, or unapproved hosts. 4. Ensure the final API URL and authentication `base_url` have the same canonical origin. 5. Disable automatic redirects or verify the origin after every redirect before forwarding authentication headers. 6. Put development endpoint support behind an explicit unsafe-development option that is unavailable during normal Agent execution. 7. Validate `jumpUrl` origins or clearly warn users before presenting links to domains outside a documented authentication allowlist. 8. Add automated tests confirming that HTTP URLs, lookalike domains, user-information URLs, and alternate ports are rejected. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Dependency Version Range Prevents Reproducible and Hash-Verified Installation<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Complete Code Snippet ```text platformdirs>=4.0,<5.0 ``` ### Technical Analysis The project permits any `platformdirs` release from version 4.0 up to, but excluding, version 5.0. This means installations performed at different times can resolve to different package artifacts. No cryptographic hashes are provided to verify the exact distribution installed. The reviewed dependency name is not an apparent typo or dependency-confusion package, and no evidence establishes that an allowed release is malicious. The security weakness is the lack of deterministic, integrity-verified dependency resolution, which leaves the installation exposed to a future compromised release or an unexpected behavioral regression within the accepted range. ### Attack Path 1. A future package release satisfying `>=4.0,<5.0` becomes compromised, malicious, or otherwise unsafe. 2. A user installs or updates the Skill without a lockfile or hash enforcement. 3. The package resolver selects that allowed release. 4. The package code executes when imported by `scripts/geekbi_auth.py`. 5. Malicious dependency code could access the same process context and user files available to the Skill, including authentication state. This path is conditional on compromise or unsafe behavior in a dependency release; no such compromise was confirmed during the static audit. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the Skill. It could potentially read local files, access persisted GeekBI authentication state, alter API requests or responses, and communicate over the network. The current likelihood is assessed as low because only one established dependency was identified and there is no evidence in the reviewed project that it is presently malicious. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact audited version. 2. Generate and enforce cryptographic hashes for the accepted wheel or source distribution. 3. Use a lockfile or hash-locked requirements file to make installation reproducible. 4. Review and update the pinned dependency through a controlled maintenance process. 5. Run dependency vulnerability and provenance checks in continuous integration. 6. Prefer trusted package indexes and prevent fallback to unapproved indexes or dependency sources. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description says the skill only queries and analyzes AliExpress shop and product data, but the detected behavior includes local persistence of login state and triggering/polling a web authorization flow to obtain access tokens. That is a material expansion of scope into credential and session handling, which increases the attack surface and can expose tokens, enable unintended account access, or surprise users and reviewers who would not expect authentication state management from a read-only research skill.

Static analysis

No suspicious patterns detected.