极鲸云美客多评论搜索

• Outcome: Review
• Latest audit: Sep 7, 2026 · 8:14 AM UTC
• Version: 0.1.0

Overview

The skill appears to support its stated Mercado Libre review-analysis purpose, but it stores login tokens in multiple local locations and exposes an unrestricted API origin option that users should review before installing.

Review this skill before installing. Use it only with the default GeekBI API origin, avoid passing custom base URLs, and be aware that login state may be saved outside the OS user config directory. After use, run the provided clear command and check for leftover .geekbi/agent-auth.json copies if credential exposure matters in your environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mercadolibre_review_search.py:55
• Finding: Unrestricted API origin permits sensitive requests to attacker-controlled or plaintext endpoints<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mercadolibre_review_search.py:55-63`, `scripts/mercadolibre_site_list.py:62-68`, `scripts/geekbi_auth.py:578-580`, and `scripts/geekbi_auth.py:700-716` **Vulnerability Type**: Arbitrary authentication and API origin with no HTTPS or hostname validation **Risk Level**: High ### Vulnerable Code ```python # scripts/mercadolibre_review_search.py:55-63 parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="名称=值；必须传 goodsId") parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` ```python # scripts/mercadolibre_site_list.py:62-68 parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--timeout", type=float, default=30) args = parser.parse_args() try: payload = authenticated_json_request( f"{args.base_url.rstrip('/')}{ENDPOINT}", args.base_url, args.timeout ) ``` ```python # scripts/geekbi_auth.py:578-580 endpoint = f"{base_url.rstrip('/')}{TOKEN_ENDPOINT}" try: response = _post_json(endpoint, {"deviceCode": pending["deviceCode"]}, timeout) ``` ```python # scripts/geekbi_auth.py:700-716 complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) _raise_action_if_needed(response_payload) return response_payload ``` ### Technical Analysis The two public query scripts accept an unrestricted `-- ...[truncated 2670 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--base-url` from production-facing commands if only the declared GeekBI service is required. 2. Otherwise, parse the URL and enforce an exact allowlist containing only the approved origin, such as `https://openapi.geekbi.com`. 3. Require HTTPS and reject: - HTTP and all non-HTTPS schemes. - Embedded usernames or passwords. - Unexpected ports. - Fragments. - Ambiguous, malformed, loopback, private-network, or link-local hosts. 4. Canonicalize the approved origin before using it as an authentication-state key. 5. Ensure the final API request origin exactly matches the validated authentication origin. 6. Disable cross-origin redirects for requests carrying authentication headers. Revalidate every redirect target before following it. 7. Validate authentication `jumpUrl` values against a separate allowlist of approved HTTPS login origins before displaying them. 8. Place the bearer value in the API’s documented authentication header and ensure it is never forwarded across origins. 9. Add automated tests covering HTTP URLs, deceptive hostnames, embedded credentials, alternate ports, redirects, loopback addresses, and private-network destinations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/geekbi_auth.py:59
• Finding: Bearer authentication state is unnecessarily mirrored into multiple filesystem locations<![CDATA[ ## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:59-79`, `scripts/geekbi_auth.py:356-369`, and `scripts/geekbi_auth.py:637-649` **Vulnerability Type**: Excessive duplication of bearer credentials in project and working directories **Risk Level**: Medium ### Vulnerable Code ```python # scripts/geekbi_auth.py:59-79 def _skill_state_path(): return _absolute_path(Path(__file__).parent.parent / AUTH_STATE_DIR / AUTH_FILE_NAME) def _workspace_state_path(): return _absolute_path(Path(os.getcwd()) / AUTH_STATE_DIR / AUTH_FILE_NAME) def _resolve_stores(): candidates = ( ResolvedStore(_user_config_state_path(), "user-config-directory"), ResolvedStore(_skill_state_path(), "skill-directory"), ResolvedStore(_workspace_state_path(), "working-directory"), ) stores = [] seen_paths = set() for store in candidates: path_key = os.path.normcase(os.fspath(store.path)) if path_key in seen_paths: continue seen_paths.add(path_key) stores.append(store) return tuple(stores) ``` ```python # scripts/geekbi_auth.py:356-369 def _write_state_files(stores, payload): normalized = _normalize_state(payload) errors = [] written = 0 for store in stores: try: _write_state_file(store, normalized) written += 1 except OSError as error: errors.append(f"{store.kind}: {_storage_probe_reason(error)}") if written == 0: reason = "；".join(errors) or "登录状态目录不可用" raise OSError(reason) ``` ```python # scripts/geekbi_auth.py:637-649 def save_token(latest): latest_server = latest["servers"].get(server_key) if not isinstance(latest_server, dict): return False, False latest_pending = latest_server.get("pending") if not isinstance(latest_pending, dict): return False, False if latest_pending.get("deviceCode") != pending.get("deviceCode"): return False, F ...[truncated 2780 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use one canonical credential store in the operating-system user configuration directory. 2. Prefer the platform credential manager or keychain for bearer tokens, storing only non-sensitive metadata in JSON. 3. Remove the Skill-directory and working-directory stores from `_resolve_stores()`. 4. If the canonical secure store is unavailable, fail securely rather than falling back to project-local credential files. 5. Preserve restrictive directory and file permissions, but verify permission changes instead of silently ignoring all failures where practical. 6. Report failures from `clear_auth_state()` so users know when credential copies remain. 7. Provide a migration routine that: - Reads existing stores once. - Moves the current state to the canonical secure store. - Securely deletes obsolete copies. - Reports any file that could not be removed. 8. Add tests confirming that login never creates `agent-auth.json` beneath the Skill or current working directory. 9. Document the token storage location, expiration behavior, logout process, and recovery procedure. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose is limited to review lookup and analysis, but the detected behavior includes site resolution, persistent login-state handling across multiple locations, and a web-based authentication flow. That mismatch is dangerous because it can cause users or reviewers to authorize broader data access, persistence, and credential-related operations than they reasonably expect from a simple review-analysis skill.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The auth state is persisted under a different namespace ("temu-research-skill") than the declared Mercado Libre review skill. This can cause credential/state confusion across skills, allowing one skill to read or overwrite another skill’s login state if they share the same backend domain and storage path conventions. In this context, the file stores bearer-token state, so namespace collision is more sensitive than an ordinary config mismatch.

Static analysis

No suspicious patterns detected.