T09 · Insecure Skill Coding Practices
Error
- Location
scripts/geekbi_auth.py:61- Finding
Authentication secrets are unnecessarily mirrored across multiple storage locations
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Shopee数据分析与市场调研
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Shopee research tool, but it should be reviewed carefully because it stores login tokens in multiple local places and allows authenticated requests to be pointed at arbitrary API hosts.
Install only if you are comfortable with the skill storing GeekBI login state locally and making live authenticated requests to GeekBI. Use it from a private workspace, avoid shared or synced directories, do not override --base-url unless testing with isolated credentials, and clear auth state when finished or before sharing the project.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:698- Finding
Authenticated API transport accepts arbitrary and non-TLS destinations
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Third-party dependency is not reproducibly pinned or hash-verified
- Content
View full analysis
=4.0,<5.0 ``` ### Technical Analysis The manifest permits any `platformdirs` release from version 4.0 up to, but not including, version 5.0. Installation results can therefore change over time without any change to the Skill repository. No package hashes or lockfile are present. The installer consequently trusts the package index and whatever matching release is selected at installation time. This is weaker than a reproducible, hash-verified dependency policy and increases exposure to: - A compromised future release within the permitted version range. - Compromise of the publisher account or package index. - Unexpected behavior changes introduced by an automatically selected release. - Difficulty proving that the audited dependency is the dependency later installed. The package name itself is not an observed typosquat, and the audit found no evidence that the current dependency is malicious. The issue is the unsafe dependency resolution policy rather than proof of a presently compromised package. ### Attack Path 1. A new or compromised `platformdirs` release is published within the allowed `>=4.0,<5.0` range. 2. A user installs or updates the Skill in an environment without an existing lock. 3. The package installer resolves the dependency to the affected release. 4. The dependency is imported by `scripts/geekbi_auth.py`. 5. Malicious or compromised package initialization code executes with the same local privileges as the Agent process. ### Impact Assessment A compromised dependency would execute within the Agent's Python process and inherit its effective user privileges. Depending on the runtime environment, that could permit access to files readable by the Agent, modification of writable project data, interception of authentication state, an ...[truncated 192 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill description, installation text, and usage examples are presented only in Chinese, with no indication that users may choose another language or that the skill is intended exclusively for a Chinese-language audience. Under the policy for natural-language violations, a skill should not impose a specific language unless it is clearly justified or optional.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes multiple local scripts and references external data retrieval, implying shell, file-read, and network capabilities, but it does not declare any explicit tool scope or permission boundaries. This creates an avoidable security gap: an agent or runtime may grant broader access than necessary, increasing the blast radius if the skill is misused, modified, or prompt-injected through referenced content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to '原样使用服务端中文 msg' requires output in Chinese regardless of the user's preferred language or locale. This is a natural-language policy concern because the file does not offer opt-in, fallback translation, or any user choice for language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This Python file contains user-facing docstrings, CLI descriptions, status/error messages, and action prompts entirely in Chinese, including outputs the user must read to complete login or troubleshoot failures. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest says the skill only uses GeekBI real-returned data for Shopee research and explicitly excludes account operations such as Seller Centre actions, which frames the skill as an analytics/query capability. This file implements local authentication state management, including clearing saved auth state and handling interactive login challenges, which is behavior beyond pure data querying/analysis and is not disclosed in the manifest description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring and all user-visible error messages are written only in Chinese, which imposes a specific language on users without offering a choice. Under the policy, forcing a language or locale without opt-in is a natural-language policy violation unless clearly documented as a justified region-specific tool.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module docstring specifies the behavior entirely in Chinese and the CLI descriptions and error messages are also fixed to Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L12 states '默认使用简体中文', which imposes a language preference as a default behavior. The file does not indicate any user opt-in or alternative language choice, so this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file contains user-facing instructions only in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The user-config storage path uses "temu-research-skill" inside a Shopee-related skill, which can cause authentication state collision or unintended token sharing between different skills if they run under the same user profile. That creates a cross-skill isolation failure where one skill may read, overwrite, or clear another skill's login state, potentially exposing access tokens or causing requests to be made under the wrong account context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file uses Chinese-only natural-language strings in the module docstring, argument validation errors, and CLI description, which indicates the skill is designed to operate in a specific language without any user opt-in or alternative locale path. Under the policy rule, locale or language constraints should either be optional for the user or clearly documented as region-specific and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code performs an HTTP request to an external Shopee AI search endpoint using user-supplied query parameters, but the file does not include any user-facing warning, confirmation, or explanatory comment about transmitting those inputs off-box. For code files, outbound network calls that transmit user data should have some visible disclosure unless the warning is documented elsewhere or clearly surfaced to the user.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This Python file builds URLs for an external API and validates API responses, indicating the skill performs outbound network requests to https://openapi.geekbi.com. The code contains no confirmation prompt, logging, or explanatory comment/docstring warning users that query parameters may be transmitted to an external service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The code performs an authenticated HTTP request to retrieve site data, which transmits request metadata to a remote service. While there is error handling, this file does not include a user-facing warning, prompt, or explanatory comment/docstring describing that a live network call will be made.
- Content