Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its SHEIN category-search purpose, but it handles login tokens and authentication links in ways users should review before installing.
Install only if you trust GeekBI and are comfortable with the skill storing reusable login tokens locally. Review and clean the .geekbi/agent-auth.json copies in your user config, skill directory, and working directory when you are done, and do not follow unexpected login links or instructions shown from service messages unless the destination is clearly trusted.
scripts/shein_category_search.py:141<![CDATA[Unrestricted Base URL Can Route Authentication Traffic to Untrusted or Plaintext Endpoints]]>
scripts/geekbi_auth.py:65<![CDATA[Plaintext Bearer Tokens Are Replicated into Project and Working Directories]]>
references/查询暂停与恢复流程.md:3<![CDATA[Unvalidated Server-Controlled Messages and URLs Are Published as Trusted Agent Output]]>
requirements.txt:1<![CDATA[Dependency Installation Is Not Reproducible or Hash-Verified]]>
The skill claims to perform SHEIN category search and analysis, but the detected implementation reportedly resolves site information instead of category data and does not provide the advertised category identifiers, hierarchy, or filtering features. While this is not a classic exploit primitive by itself, such misrepresentation is dangerous because it can mislead operators into granting capabilities or trusting outputs for decisions the skill is not actually performing, masking unauthorized or irrelevant network actions.
The skill claims to perform SHEIN category search and analysis, but the detected implementation reportedly resolves site information instead of category data and does not provide the advertised category identifiers, hierarchy, or filtering features. While this is not a classic exploit primitive by itself, such misrepresentation is dangerous because it can mislead operators into granting capabilities or trusting outputs for decisions the skill is not actually performing, masking unauthorized or irrelevant network actions.
The instruction "安装后直接用中文描述目标即可" explicitly directs users to interact in Chinese. Under the policy, language constraints should not be forced unless the skill offers a language choice, opt-in, or a clearly justified region-specific limitation, which is not documented here.
The skill invokes shell commands, reads local reference files, and performs network-backed queries, but it does not declare any tool scope or permission boundaries. This creates an authority mismatch: a caller reviewing only the manifest cannot tell that the skill can execute commands and access external services, increasing the risk of unintended command execution or data access under overly broad runtime privileges.
The instruction '输出中文业务结论' forces responses in Chinese for all users. This is a natural-language locale policy issue because the file does not offer a language choice or require Chinese only in a clearly documented region-specific context.
The manifest describes a SHEIN category search and analytics skill, but this file implements a standalone login-state subsystem with multi-location storage resolution in user config, skill, and working directories. While network access to GeekBI is expected for search, persistent credential/state management is a broader behavior not disclosed by the skill description.
The file’s user-facing description, argument help text, and error messages are all in Chinese, and the input help explicitly constrains the lookup to Chinese site names. This imposes a language/locale requirement without any opt-in or explanation that the tool is intentionally region-specific, which matches the policy’s locale-constraint concern.
This Python file contains its module docstring and user-facing status/error messages entirely in Chinese, and there is no indication that users can opt into another language. The policy for this audit flags language or locale constraints when a skill forces a specific language without user choice or documented justification.
The manifest presents the skill as a category search/analysis capability, but this module also exposes a command-line interface for storage diagnostics and clearing auth state. That operational management surface is not reflected in the manifest's user-facing intent.
This Python file performs an authenticated HTTP request to a remote API, which may transmit user or system context such as authentication data, but the code provides no user-facing warning, confirmation, or explanatory comment/docstring about that network action. Under the code-file criteria, network calls should be disclosed unless the operation is clearly communicated elsewhere in the skill description, which is not evident in this file alone.
No suspicious patterns detected.