极鲸云Ozon商品搜索

• Outcome: Review
• Latest audit: Sep 7, 2026 · 8:07 AM UTC
• Version: 0.1.0

Overview

The skill appears to be a legitimate Ozon product-search integration, but it stores GeekBI access tokens in multiple local locations and allows overly broad API destinations.

Review this before installing if you will authenticate with GeekBI. The skill is not showing destructive or deceptive behavior, but users should understand that it can create local bearer-token files in multiple places and can be pointed at non-default API hosts. Prefer installing only if you trust the publisher, keep workspaces private, use the provided clear command when done, and avoid supplying custom base URLs unless you fully trust the endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/geekbi_auth.py:68
• Finding: Bearer token state is unnecessarily replicated across multiple filesystem locations## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:68-82`, `scripts/geekbi_auth.py:371-380`, and `scripts/geekbi_auth.py:637-648` **Vulnerability Type**: Excessive credential persistence and insecure secret storage **Risk Level**: Medium ### Vulnerable Code ```python def _user_config_state_path(): return _absolute_path( user_config_path("GeekBI", appauthor=False, ensure_exists=True) / "temu-research-skill" / AUTH_FILE_NAME ) def _skill_state_path(): return _absolute_path(Path(__file__).parent.parent / AUTH_STATE_DIR / AUTH_FILE_NAME) def _workspace_state_path(): return _absolute_path(Path(os.getcwd()) / AUTH_STATE_DIR / AUTH_FILE_NAME) ``` ```python def _write_state_files(stores, payload): normalized = _normalize_state(payload) errors = [] written = 0 for store in stores: try: _write_state_file(store, normalized) written += 1 except OSError as error: errors.append(f"{store.kind}: {_storage_probe_reason(error)}") ``` ```python def save_token(latest): latest_server = latest["servers"].get(server_key) if not isinstance(latest_server, dict): return False, False latest_pending = latest_server.get("pending") if not isinstance(latest_pending, dict): return False, False if latest_pending.get("deviceCode") != pending.get("deviceCode"): return False, False _remove_access_token(latest_server) latest_server["accessToken"] = access_token latest_server["accessTokenExpiresAt"] = now + max(0, expires_in - 30) ``` ### Technical Analysis The authentication state contains a reusable bearer access token. Instead of maintaining one protected user-level credential store, the implementation mirrors the same state into: 1. The operating-system user configuration directory; 2. The installed Skill directory; ...[truncated 2652 chars]
• Remediation: ## Remediation Suggestions 1. Store authentication state only in one Ozon-specific user configuration location. 2. Remove `_skill_state_path`, `_workspace_state_path`, and credential mirroring. 3. Replace `temu-research-skill` with an Ozon-specific and application-specific directory name. 4. Prefer the operating system's credential vault, such as Keychain, Credential Manager, or Secret Service, for the bearer token. 5. If file storage remains necessary, preserve restrictive permissions and fail closed if they cannot be enforced. 6. Store only the minimum state required for authentication and avoid retaining expired device codes or tokens. 7. Add a migration routine that moves valid state to the protected store and deletes legacy copies from Skill and workspace directories. 8. Document token revocation and provide a command that reliably removes every legacy token copy. 9. Add tests confirming that successful authentication creates no credential-bearing file beneath the Skill installation or current working directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/geekbi_auth.py:698
• Finding: Authenticated request helper does not enforce HTTPS, approved hosts, or same-origin token delivery## Vulnerability Details **File Location**: `scripts/geekbi_auth.py:698-721`; exposed through `scripts/ozon_goods_search.py:99-107`, `scripts/ozon_goods_info.py:47-54`, and `scripts/ozon_site_list.py:51-57` **Vulnerability Type**: Unrestricted network destination and unsafe bearer-token routing **Risk Level**: Medium ### Vulnerable Code ```python def authenticated_json_request( url, base_url, timeout, *, method="GET", body=None, headers=None, ): complete_pending_login(base_url, timeout) request_headers = _api_headers() if headers: request_headers.update(headers) authorization = _authorization_header(base_url) if authorization: request_headers["token"] = authorization request = Request( url, data=body, headers=request_headers, method=method, ) try: with urlopen(request, timeout=timeout) as response: response_payload = _read_json_response(response) ``` Each query command also exposes an unrestricted base URL. For example: ```python parser.add_argument("--base-url", default=DEFAULT_BASE_URL) parser.add_argument("--param", action="append", default=[], help="查询条件，格式为 名称=值") parser.add_argument("--timeout", type=float, default=45) args = parser.parse_args() try: params = parse_params(args.param) payload = authenticated_json_request( build_url(args.base_url, ENDPOINT, params), args.base_url, args.timeout ) ``` ### Technical Analysis `authenticated_json_request` accepts `url` and `base_url` independently. It retrieves a bearer token associated with `base_url` and then sends that token to `url` without confirming that both values have the same normalized HTTPS origin. Consequently, any local caller that can invoke or import this helper can supply the legitimate GeekBI origin as `base_url` while supplying an attacker-controlled U ...[truncated 3386 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--base-url` from production-facing commands unless alternate endpoints are an explicit supported requirement. 2. Allowlist the exact production origin `https://openapi.geekbi.com`. 3. Parse URLs with `urllib.parse.urlsplit` and require the `https` scheme. 4. Normalize scheme, hostname, and effective port before comparing origins. 5. Before attaching a token, require `url` and `base_url` to have identical approved origins. 6. Refactor the request helper to accept only an endpoint path and construct the complete URL internally from a trusted constant. 7. Validate server-provided `jumpUrl` values against an explicit list of approved HTTPS authorization origins before presenting them to users. 8. Prevent authenticated requests from following cross-origin redirects, or strip the token header before any redirect. 9. Reject loopback, link-local, private-network, and nonstandard destinations if configurable endpoints must remain available. 10. Add tests proving that mismatched origins, HTTP URLs, user-information components, deceptive subdomains, alternate ports, and cross-origin redirects are rejected before a token is loaded or transmitted.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill invokes local reference files and external tools/scripts (`ozon_site_list.py`, `ozon_goods_search.py`, `ozon_goods_info.py`), which implies file-read, shell, and network capabilities, yet no permissions are declared. This creates a transparency and policy-enforcement gap: a host may allow the skill to operate without users or reviewers understanding that it can read local files and make outbound requests.

Static analysis

No suspicious patterns detected.