Security audit

极鲸云Coupang商品搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do Coupang product research as advertised, but its login flow stores bearer tokens in multiple plaintext locations and displays unvalidated service-supplied login links.

Review before installing. Use it only if you trust GeekBI and need Coupang Korea product data. Treat any login link it displays with caution, verify the destination manually, avoid custom --base-url values unless you control the endpoint, and be aware that authentication tokens may be written to local plaintext files in multiple directories.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: references/查询暂停与恢复流程.md:3
Finding: Unvalidated Server-Controlled Messages and Links Are Reproduced in Agent Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/geekbi_auth.py:69
Finding: Bearer Tokens Are Replicated in Plaintext Across Multiple Storage Locations and an Incorrect Cross-Skill Namespace
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill description promises a broad product-analysis capability, but the observed behavior appears to center on site-list lookup and site parsing rather than the claimed product search and analytics workflow. This mismatch is dangerous because policy, review, and user trust are based on the declared purpose; hidden or materially different behavior can bypass appropriate scrutiny and cause the agent to act outside expected boundaries.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares shell, file-read, and network-capable behavior but does not define any explicit tool scope or permission boundaries. In an agent environment, this can enable over-privileged execution, making unintended file access, arbitrary command execution, or outbound requests possible if the skill is invoked or later expanded without strict controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are broad enough that the skill may activate for many general discussions about Coupang, product selection, market trends, or fulfillment markings without clear gating. Over-broad activation increases the chance of unnecessary network/script execution, accidental data disclosure into tools, or the skill taking over conversations where a narrower tool should be used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The display name, short description, and default prompt are all written in Chinese and indicate the skill operates in that language, but there is no indication that users can choose another language or explicitly opt in. This can violate a language/locale policy when the skill is not clearly documented as intentionally region- or language-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring is written as a fixed Chinese description, and the CLI-facing descriptions and validation messages throughout the file are also Chinese-only. This indicates a language-specific user experience without any visible opt-in or alternative locale handling, which matches the policy concern for forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code raises an error stating that Coupang currently only supports the Korea site, siteId=1, which enforces a locale restriction in natural-language user-facing behavior. Under the policy, forcing a specific locale without user opt-in or documented justification is a reportable natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code hardcodes Chinese-language descriptions, help text, and user-facing error/output strings, and defaults the country argument to "韩国". That creates a language/locale constraint without offering the user a choice or documenting a justified regional limitation, which matches the policy-violation category for language/locale issues.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's natural-language strings, including the module docstring, exception messages, argparse description, and help text, are consistently presented only in Chinese. There is no opt-in, locale selection, or justification for restricting the skill's user-facing interface to a specific language, which is a language/locale policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auth state path is stored under temu-research-skill in the user config directory even though this skill is for Coupang. This can cause cross-skill state confusion, accidental token reuse, or one skill reading or overwriting another skill's authentication state if both run under the same user profile.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The clear_auth_state function removes persisted login-state files via unlink() across multiple storage locations, but the function itself has no docstring, comment, log, or confirmation prompt indicating that local authentication state will be deleted. This is a safety-relevant file deletion operation, and the only CLI help text says '清除登录状态', which does not disclose scope or side effects in the code path itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README presents all user-facing instructions and capability descriptions only in Chinese. This can constitute a language policy violation when the skill forces a specific language without giving users an explicit choice or indicating that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.