T09 · Insecure Skill Coding Practices
Error
- Location
scripts/shopee_goods_search.py:59- Finding
Unrestricted Base URL Enables Arbitrary Network Requests and Insecure Credential Transport
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Shopee商品搜索
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a read-only Shopee research tool, but it under-discloses sensitive GeekBI login-token handling and gives the scripts broader network and local storage behavior than users would expect.
Review before installing. This skill sends Shopee research queries to GeekBI and may require a GeekBI login. It stores GeekBI bearer tokens locally in multiple places and exposes a base-url option that should not be used with untrusted or non-HTTPS endpoints. Only install it if you trust the publisher and are comfortable with local token persistence; clear auth state after use if the workspace is shared.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/geekbi_auth.py:371- Finding
Bearer Tokens Are Replicated in Plaintext Across Multiple Filesystem Locations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:498- Finding
Unvalidated Server-Supplied Action URLs Create a Phishing and Unsafe Navigation Channel
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation persists login state and access tokens, handles web login challenges, and refreshes authentication tokens while the skill description omits these behaviors, operators cannot accurately assess the credential-handling risk. Hidden or undocumented auth flows are dangerous because they introduce secrets storage, session management, and possible account misuse surfaces beyond the stated read-only analytics purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation persists login state and access tokens, handles web login challenges, and refreshes authentication tokens while the skill description omits these behaviors, operators cannot accurately assess the credential-handling risk. Hidden or undocumented auth flows are dangerous because they introduce secrets storage, session management, and possible account misuse surfaces beyond the stated read-only analytics purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares no explicit tool scope even though its documented workflow invokes local scripts that imply file read, network, and shell execution. Without an allowlist or permissions boundary, the runtime may grant broader capabilities than users or reviewers expect, increasing the chance of unintended file access, arbitrary command execution, or uncontrolled outbound requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file contains natural-language strings that force a specific language/locale for descriptions and user-visible messages. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; that justification is not present in this file.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring and manifest indicate this file manages GeekBI authentication for the current Shopee product search skill, but the user-config storage path is hardcoded under "temu-research-skill". This inline implementation detail actively contradicts the skill identity implied by the file and manifest, causing auth state to be stored in another skill's namespace.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. The module docstring is written as an instructionally fixed Chinese description with no indication that language is configurable or user-selected, which can violate a policy requiring language choice rather than forcing a specific locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The natural-language strings in the docstring, argument descriptions, validation errors, and output messages are all fixed in Chinese, with no option for the user to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
This Python file is a code file, so SQP-2 applies to safety-relevant operations such as network calls that transmit user or system data. The file defines an external API base URL for Shopee-related requests, but there is no nearby comment, docstring detail, logging, or user-facing notice in this file explaining that query parameters may be sent to a remote service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code performs an authenticated HTTP request to a remote API, which may transmit system or user-associated authentication context, but the script provides no user-facing notice at runtime beyond a generic description. Aside from the brief module docstring, there is no explicit warning, log message, or comment disclosing that a live authenticated network call will occur.
- Content