Security audit

极鲸云 Shein 数据分析与市场调研

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its SHEIN research purpose, but it needs Review because it stores GeekBI login state under a mismatched Temu namespace and can forward user-supplied images or URLs to GeekBI without prominent consent language.

Install only if you are comfortable using GeekBI for authenticated SHEIN market research. Do not submit confidential, personal, proprietary, or private-network images unless you intend them to be sent to GeekBI for analysis. The publisher should fix the auth storage namespace and add clearer privacy/consent language for image uploads and remote URL fetching.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly instructs the agent to read local reference files, invoke multiple scripts, and perform live queries, which implies file_read, shell, and network capabilities despite no declared permissions boundary. This is dangerous because hidden or undeclared capabilities reduce auditability and can let a broadly-invoked skill access local resources or external services in ways users and reviewers do not expect.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The auth state path uses 'temu-research-skill' under the GeekBI config directory even though this is a SHEIN-related skill, creating a risk of credential/state collision across different skills. If another skill reuses the same storage namespace, tokens or pending login state may be read, overwritten, or confused across contexts, causing unintended account mixing or cross-skill access to authenticated state.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README encourages users to upload product images for image-based matching without disclosing whether those images are sent to 极鲸云 or another external processor. This creates a real transparency and privacy risk: users may submit proprietary supplier photos, customer images, or other sensitive assets without informed consent about off-platform transfer, storage, or retention.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The invocation description is extremely broad and overlaps with many generic research, shopping, trend, and analysis requests, making accidental or excessive routing into this skill more likely. In combination with network and script execution behavior, over-broad triggering increases the chance the skill is invoked for requests outside its narrowly intended context, causing unnecessary data access or tool use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly permits user-supplied images from local files, remote URLs, stdin, Data URIs, and base64, and states that remote images are fetched locally and then uploaded. Without an explicit privacy and data-transmission warning, users may unknowingly send sensitive images or cause the system to retrieve third-party content, creating confidentiality and consent risks. In the context of an ecommerce image-search skill, this is plausible operational behavior, but the broad source support increases the chance of accidental exposure rather than reducing it.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script accepts arbitrary http/https image URLs, fetches the image content, and then uploads that content to the GeekBI external API without any explicit confirmation, allowlisting, or warning about third-party data transfer. This can cause unintended disclosure of sensitive images or internal-only resources if a user provides a private URL, and the skill context increases risk because the feature is specifically designed to ingest user-supplied images for external analysis.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.