T09 · Insecure Skill Coding Practices
Error
- Location
scripts/coupang_goods_search.py:64- Finding
Authentication Traffic Can Be Directed to an Unrestricted or Plaintext API Origin
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Coupang类目搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill's Coupang research purpose is coherent, but it needs Review because it persists GeekBI login state in multiple local locations and accepts unvalidated authentication endpoints and links.
Review before installing. Use it only if you are comfortable signing into GeekBI and having local auth state stored outside a single credential vault. Avoid custom --base-url values, verify any login link destination before opening it, and clear the auth state when finished if the workspace may be shared or archived.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/geekbi_auth.py:499- Finding
Server-Controlled Messages and Links Are Relayed to Users Without Trust Validation
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/geekbi_auth.py:63- Finding
Bearer Tokens Are Unnecessarily Replicated Across Multiple Storage Locations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill actually performs authentication flows, token acquisition/refresh, and local persistence of auth state while presenting itself as a simple category-research tool, that hidden behavior materially changes the security profile. Undisclosed credential handling and token storage increase the risk of secret exposure, persistence abuse, and users invoking a skill without informed consent about authentication side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill actually performs authentication flows, token acquisition/refresh, and local persistence of auth state while presenting itself as a simple category-research tool, that hidden behavior materially changes the security profile. Undisclosed credential handling and token storage increase the risk of secret exposure, persistence abuse, and users invoking a skill without informed consent about authentication side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill actually performs authentication flows, token acquisition/refresh, and local persistence of auth state while presenting itself as a simple category-research tool, that hidden behavior materially changes the security profile. Undisclosed credential handling and token storage increase the risk of secret exposure, persistence abuse, and users invoking a skill without informed consent about authentication side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill actually performs authentication flows, token acquisition/refresh, and local persistence of auth state while presenting itself as a simple category-research tool, that hidden behavior materially changes the security profile. Undisclosed credential handling and token storage increase the risk of secret exposure, persistence abuse, and users invoking a skill without informed consent about authentication side effects.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill references executable scripts and operational flows that imply file read, network access, and shell execution, but it declares no explicit tool scope or permissions boundaries. This is dangerous because the runtime may grant broader capabilities than users or reviewers expect, increasing the chance of unintended data access, outbound requests, or command execution through the skill path.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The invocation description says to use the skill whenever the user mentions terms like '品类研究', '赛道分析', or '类目选品', which are broad business phrases that could appear in many ordinary conversations. It does not provide exclusion conditions or clearer scope boundaries for when this skill should activate versus other ecommerce-analysis skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The error message and conditional logic hard-code support to the Korean Coupang site only (
siteId=1). This is a natural-language locale policy constraint embedded in code without offering a user choice or documenting a justified region-specific limitation, which matches the policy-violation criterion.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill for querying Coupang display category trees, parent chains, and category-level research/selection analysis. This script instead calls the
/api/v1/coupang/goods/ai-searchendpoint, accepts product-search filters such as keyword, price, rating, PV, and sales, and validates the response as a goods search result. That is a substantive behavior mismatch rather than an implementation detail of category lookup.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The inline module documentation says
调用极鲸云 Coupang 商品搜索接口, which states the script is a Coupang product-search client. Given the skill's declared purpose is category tree/parent-chain lookup and category research, this documentation points to a different intent than the manifest-level documentation. That is an active documentation-versus-implemented-skill contradiction, not just an omission.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains natural-language strings entirely in Chinese, including the module docstring and multiple error messages shown to users. Under the policy for natural-language violations, forcing a specific language without offering user choice or documenting a justified locale constraint is a reportable issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring specifies behavior in Chinese and the script's user-facing descriptions and error messages are exclusively Chinese, which can amount to a language policy constraint without user opt-in. There is no indication that users may select another language or that the locale restriction is intentionally limited to a justified region-specific use case.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a skill for querying Coupang category trees and researching category/product metrics, but this file implements a reusable GeekBI agent login subsystem with persistent token storage, device-code login flow handling, and authenticated HTTP request wrapping. Authentication may support the skill operationally, but the file's behavior is materially broader than the manifest's user-facing description and introduces account/session management capabilities not disclosed there.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-config auth state path uses the directory name "temu-research-skill" even though this skill is for Coupang category research. That mismatch can cause credential/state sharing or collision across different skills that reuse the same utility, potentially mixing login sessions between unrelated tools and violating isolation assumptions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The natural-language content of this skill description is entirely in Chinese, which can amount to forcing a specific language on users without an explicit choice. The policy for this category applies to all file types and specifically calls out language or locale constraints without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The user-facing display name, description, and default prompt are all written exclusively in Chinese, which indicates a fixed language choice with no visible option for users to select another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The error message states that Coupang is only supported for the Korea site (
siteId=1), which hard-codes a locale constraint in user-facing behavior. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the constraint is clearly documented and justified as region-specific.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs an authenticated HTTP request to a remote endpoint, which may transmit user or system-associated data such as the base URL context or authentication material. In this file there is no user-facing warning, confirmation, or explanatory comment/docstring near the operation describing that a network call will occur.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code presents its primary user-facing description in Chinese and later emits Chinese-only operational/error messages, indicating a fixed locale without user opt-in. Under the stated policy, forcing a specific language without offering a choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple exceptions, prompts, and CLI messages are hardcoded in Chinese, including login, storage, and action-required flows. Because the file does not offer the user a language choice or document a justified locale restriction, this appears to violate the language/locale policy.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest frames the skill as a read-oriented Coupang category search and research tool, but the script exposes an administrative command that deletes authentication state files across multiple storage locations. That local session-management capability is not part of the stated end-user purpose and is not necessary to understand from the manifest's description of category analysis behavior.
- Content