T09 · Insecure Skill Coding Practices
Error
- Location
scripts/geekbi_auth.py:68- Finding
Authentication Tokens Are Mirrored Across Excessive and Incorrectly Namespaced Storage Locations
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Ozon数据分析与市场调研
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent GeekBI/Ozon research skill, but it handles login tokens and user-facing links in ways that are too broad and under-disclosed for automatic install.
Review before installing. Use only the official GeekBI API origin, avoid running it from shared or synced workspaces, treat the GeekBI login as sensitive, and verify any login/upgrade/action link before opening it. Be aware that auth state may be stored in .geekbi files and in a GeekBI/temu-research-skill user-config path.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ozon_search_common.py:104- Finding
Authenticated Network Requests Permit Unrestricted and Potentially Insecure API Origins
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/geekbi_auth.py:500- Finding
Unvalidated Server-Controlled Action Links Can Be Injected into Agent Output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is Ozon research and analysis, but the detected behavior reportedly includes authentication state storage, token handling, local state files, locks, and web authorization flow management. Hidden auth and local persistence capabilities materially expand the trust boundary and can expose credentials, session material, or local filesystem state in ways the user was not informed about.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares executable capabilities such as file read, network, and shell behavior through referenced scripts, but it does not define any explicit tool scope or permission boundaries. In an agent environment, this increases the risk of overbroad tool use, unintended data access, or execution paths beyond the user-visible purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill content and operational instructions are entirely written in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown states that when no site is specified, the skill defaults to the Russian site. This is a natural-language locale policy choice imposed automatically rather than offered as a user-selectable option, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This file presents user-facing descriptions, errors, and action messages exclusively in Chinese, including CLI help and runtime messages. That forces a specific language/locale without any visible user opt-in or documented locale constraint in the file.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The auth state path is hardcoded under "temu-research-skill" even though this skill is for Ozon research. That creates cross-skill state confusion: another skill using the same path could read, overwrite, or reuse login state, potentially causing token mix-ups, unintended account linkage, or authentication failures. In a data-research skill that relies on authenticated API access, cross-skill token contamination is more dangerous because it may expose one skill's session to another skill context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The clear_auth_state function unlinks authentication state files across resolved storage locations, which is a destructive file operation affecting persisted login data. In this file, that deletion path has no confirmation prompt and no user-facing warning near the operation itself explaining that stored login state will be removed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, CLI description, and validation/error messages are written only in Chinese, which imposes a specific language on users without offering a locale choice or documenting a justified locale restriction. This matches the language/locale policy violation category for natural-language content in code files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file's docstring and later CLI/help and error messages are written in Chinese, which imposes a specific language on users without any visible opt-in or explanation that the tool is intended only for a Chinese-speaking context. This matches the language/locale policy violation category for natural-language content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Several user-visible validation errors are emitted only in Chinese, enforcing a language choice implicitly. No opt-in, fallback language, or documented justification for the locale restriction is present in the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The argparse description and parameter help are presented only in Chinese, requiring that locale for normal use. The file does not provide an alternative language or state that the tool is region- or language-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains natural-language strings exclusively in Chinese, including the module description and multiple error messages shown to users. Under the policy, forcing a specific language without user opt-in or clear justification is a locale/language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The display name, short description, and default prompt are all written in Chinese, which implies a fixed language experience. There is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The instruction explicitly requires preserving Chinese terms and using them for display and matching, which imposes a language-specific behavior. The file does not indicate that the user can choose another language or that this Chinese-language constraint is required for a documented region-specific compliance reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring, argument description, and user-facing error messages are all written only in Chinese, which imposes a specific language on users without offering a language choice or documenting that the skill is intended solely for a Chinese-speaking or region-specific context. This matches the policy category for language or locale constraints expressed in natural language.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This Python skill performs an authenticated HTTP request using the provided goods ID, optional mall ID, and site ID, but the file contains no confirmation prompt, user-facing log/print before transmission, or comment/docstring explaining that these values are sent to a remote API. For code files, outbound network operations that transmit user or system data should have some visible disclosure unless already clearly warned elsewhere.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs an authenticated network request to the Ozon search API using user-supplied query parameters, which may transmit user-entered data to an external service. While the module docstring says it calls the Ozon search API, there is no explicit user-facing warning at the point of execution about network transmission or external data sharing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s user-facing natural language is exclusively Chinese, including the module docstring, CLI description, help text, and validation/error messages. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring, CLI description, help text, and error messages are all written in Chinese, which imposes a specific language on users. Under the policy, locale or language restrictions should either provide user choice or be clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains natural-language strings that assume Chinese as the required language, starting with the module docstring. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or an explicit justification.
- Content