Security audit

极鲸云美客多商品搜索

Security checks for vulnerabilities and agentic risk

Overview

This skill does query Mercado Libre data through GeekBI, but it also stores login tokens in multiple local locations, including the current workspace, so users should review it before installing.

Install only if you are comfortable authenticating with GeekBI and having its bearer token stored locally. Before using it in important repositories or shared/synced folders, confirm where .geekbi/agent-auth.json may be written, avoid custom base URLs unless trusted, and treat any displayed login link as untrusted until you verify the domain.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/geekbi_auth.py:65
Finding: Bearer Tokens Are Replicated into Project and Workspace Directories
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/geekbi_auth.py:497
Finding: Unvalidated Server-Controlled Messages and Links Are Relayed to Users
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared functionality is Mercado Libre product search and analysis, but the detected behavior reportedly includes credential persistence, token management, login flow handling, and local state manipulation unrelated to the user-facing description. This mismatch is dangerous because it can conceal sensitive authentication activity behind an innocuous data-analysis label, undermining user consent, review, and monitoring.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared functionality is Mercado Libre product search and analysis, but the detected behavior reportedly includes credential persistence, token management, login flow handling, and local state manipulation unrelated to the user-facing description. This mismatch is dangerous because it can conceal sensitive authentication activity behind an innocuous data-analysis label, undermining user consent, review, and monitoring.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill declares no explicit tool scope or permission boundaries even though the referenced behavior implies file access, network access, and shell/script execution. In an agent environment, missing tool restrictions can allow broader-than-expected execution paths and make it harder to enforce least privilege or review whether the skill only performs the stated Mercado Libre analysis tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger description is broad enough to match many generic product-analysis requests, which increases the chance the agent invokes this skill outside its intended context. Over-broad routing is risky because the skill may gain access to tools, data, or external services when a narrower or safer skill would have been more appropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and many user-facing messages are written only in Chinese, indicating the skill communicates in a fixed language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not present in this file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill should query Mercado Libre product data from GeekBI and explicitly limits itself to returning GeekBI data, not broader account-oriented behavior. This file implements a full persistent authentication subsystem: it creates local state files, mirrors tokens across multiple directories, polls login completion, and exposes a CLI command to clear auth state, which is broader than the described search/analysis functionality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python file contains its docstring and all user-visible error messages exclusively in Chinese, which imposes a specific language on users. Under the policy rule, forcing a locale/language without offering choice or documenting a justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains its primary natural-language interface entirely in Chinese, including the module description, CLI argument help, and error messages. Because the skill does not offer any language/locale opt-in or document that it is intentionally China/Chinese-specific, it appears to impose a fixed language on users, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README is entirely written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is a justified locale-specific constraint. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The storage_status function enumerates concrete local paths, probes readability/writability/locking, and reports detailed storage diagnostics. That operational capability is not part of the manifest's stated purpose of querying and analyzing Mercado Libre product data, so the implementation surface is broader than the declared behavior.
Content: No source excerpt is available for this finding.