T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ozon_goods_search.py:99- Finding
Unrestricted API endpoint override permits sensitive requests over untrusted or plaintext transport
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Ozon商品搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches an Ozon product-research purpose, but it handles account tokens and network destinations in ways users should review before installing.
Review this before installing if you will authenticate with a GeekBI account. Use only the default GeekBI endpoint, do not let prompts or copied commands set --base-url, and be aware that login tokens may be written under both user config and local .geekbi paths until cleared.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:69- Finding
Bearer-token state is unnecessarily replicated into Skill and working directories
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A documented Ozon product-search skill should not silently include generic login, token management, local state persistence, file locking, and storage administration unless those behaviors are clearly declared and justified. This mismatch is dangerous because it can hide credential-handling and local filesystem side effects behind an innocuous product-analysis description, undermining user consent and security review.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A documented Ozon product-search skill should not silently include generic login, token management, local state persistence, file locking, and storage administration unless those behaviors are clearly declared and justified. This mismatch is dangerous because it can hide credential-handling and local filesystem side effects behind an innocuous product-analysis description, undermining user consent and security review.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill advertises operational capabilities that imply file, network, and shell access but does not declare any explicit tool scope or permissions boundary. That makes the effective privilege surface opaque to reviewers and increases the risk of overbroad execution, especially if the underlying implementation can access local files or invoke shell commands during auth or API workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation language is broad enough to match many ordinary product-analysis requests, which can cause the skill to trigger outside clearly bounded user intent. In a skill with networked data access and possible hidden auth/state behaviors, overbroad triggering increases the chance of unnecessary external queries or invocation of sensitive backend logic without explicit user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains user-facing natural-language text that is fixed to Chinese, starting with the module docstring and repeated throughout CLI descriptions and error messages. The policy requires avoiding forced language or locale choices unless the skill offers opt-in or clearly documents a justified regional constraint, which is not present in this file.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest describes a skill for querying and analyzing Ozon product data and explicitly avoids seller-backend operations, but this file implements a full device-login workflow with persistent auth storage, token refresh/polling, and a CLI command to clear login state. While network access to GeekBI is expected, maintaining local authentication state is a materially broader behavior than the user-facing description of data-only querying.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user config path stores auth state under "temu-research-skill" even though this file belongs to a different GeekBI Ozon skill. This can cause cross-skill state collision or unintended token reuse between unrelated skills that share the same local account, potentially exposing one skill's authentication context to another and breaking isolation assumptions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description and installation instructions are entirely in Chinese, and the file does not indicate that the skill is region-specific or provide any language-selection option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
All user-facing instructions and behavior descriptions in this file are presented in Chinese, with no indication that other languages are supported or that the user can choose the language. This can be a language/locale policy issue if the skill effectively forces a specific language without explicit user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The clear_auth_state function deletes local authentication state files, which is a file-deletion operation affecting user state. Although the CLI command name suggests clearing, this file provides no explicit warning, confirmation prompt, or explanatory comment near the destructive action itself.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings that force a specific language/locale for the interface, beginning with the module docstring in Chinese and continuing throughout argparse/help and error text. The policy allows locale constraints only when user choice or clear justification is provided, which is not present here.
- Content