T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/shopee_goods_search.py:54- Finding
Unrestricted API Base URL Enables Server-Side Request Forgery and Phishing Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
极鲸云Shopee店铺搜索
Security checks for vulnerabilities and agentic risk
Overview
This is a read-only Shopee research skill, but it needs Review because it stores login tokens in multiple local places and does not tightly restrict API destinations, redirects, or login links.
Review carefully before installing. Use only the default GeekBI endpoint, do not click login links unless the destination is a trusted GeekBI host, and avoid running the skill from shared or published workspaces because it may create .geekbi/agent-auth.json containing bearer login state. Prefer a version that stores credentials only in a protected per-user location and validates API hosts, redirects, and login URLs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/geekbi_auth.py:698- Finding
Bearer Token May Be Forwarded Across Origins During HTTP Redirects
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/geekbi_auth.py:69- Finding
Bearer Credentials Are Unnecessarily Mirrored into Skill and Working Directories
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的核心能力是“店铺详情及店铺商品分析”，重点是围绕店铺 ID、竞店调研、经营对标、店铺级指标进行分析。但代码仅实现了一个商品搜索脚本：接受 keyword、catId、siteId、isCross、排序及多个数值/日期区间参数，调用商品 AI 搜索接口返回搜索结果。虽然声明中提到可分析店铺商品，代码与 Shopee 商品数据有关，但其主要行为明显是商品检索，不是店铺详情查询或店铺经营分析。因此描述与代码实际功能存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述聚焦于 Shopee 店铺和商品层面的经营分析能力，例如销量、销售额、评分、粉丝、类目结构和趋势研究；而代码仅实现了一个站点解析脚本：请求站点列表接口，校验响应，并按国家中文名、英文名、地区代码或站点 ID 过滤匹配站点。两者在主要目的、处理对象和输入触发条件上都明显不一致。该代码没有体现任何店铺详情查询、商品分析或经营对标逻辑，因此应判定为描述与实际行为不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该文档整体以中文呈现技能名称、说明和示例，但没有说明语言要求、可选语言，或提供用户可选择的语言/locale 机制。按规则，若技能在自然语言层面强制特定语言且未获用户选择或合理限定，属于语言/locale 政策风险。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The display name, description, and default prompt are all written in Chinese, and the prompt text provides no indication that users may choose another language. This can constitute a language/locale policy violation when a skill implicitly enforces a specific language without explicit opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instruction '原样使用服务端中文
msg' forces Chinese output from the skill based on server response, with no indication that the user can choose another language or opt in to Chinese. This is a natural-language locale policy concern because it mandates a specific language regardless of user preference.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a skill for querying and analyzing Shopee shop and product data, explicitly emphasizing read-only research and not mentioning account/login orchestration. This module is dedicated to GeekBI agent authentication, bearer-token handling, persistent login state, and interactive login challenges, which is broader operational behavior than the manifest claims.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This Python file contains user-facing natural-language strings entirely in Chinese, including the module description, exception messages, CLI help text, and error output. The skill does not offer a language choice or document a justified locale restriction, which can violate language/locale policy for general-purpose skills.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring, CLI description/help text, and error messages are all hard-coded in Chinese, which imposes a specific language on users with no opt-in or alternative locale support. This matches the policy category for language or locale violations because the script does not provide any language selection or document a justified region-specific constraint.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring and manifest context identify this as a GeekBI/Shopee-related skill, but the configured user state path is stored under
temu-research-skill. That inline identifier actively points to a different skill/domain and can mislead maintainers about which skill owns the persisted authentication state.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest says the skill does not handle Seller Centre write operations, but otherwise frames the skill as shop analytics/search functionality. This file adds a separate maintenance capability to delete persisted auth files via
clear_auth_state, which is not part of the user-facing analytical purpose described in the manifest.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This Python file makes an authenticated HTTP request to an external API using the provided mall ID and site ID, but the file contains no user-facing warning, confirmation, or comment/docstring disclosing that data will be sent over the network. For code files, outbound network operations should have some visible disclosure unless the warning exists elsewhere; none is present in this file.
- Content