Security audit

Sushiro Skill

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do real Sushiro queue lookups, but it ships a shared backend token and exposes a raw API passthrough that users should review carefully.

Review before installing. Expect live requests to Sushiro China's backend, avoid precise home or work coordinates with --near, avoid raw mode unless you understand the upstream API impact, and prefer a version that removes the shared token or limits access to the documented queue endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill documentation explicitly states that a shared Bearer token for the WeChat mini-program backend is hardcoded in the script. Even if the API is functionally used for read-only queue lookups, embedding and distributing a reusable credential exposes an authentication secret that can be extracted, reused outside the intended client, and potentially abused until rotated. The skill context makes this more dangerous because it normalizes unauthorized access to an unofficial internal backend while claiming 'no API key required,' which may mislead operators into treating the integration as public and low-risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The `raw` subcommand exposes a generic passthrough to the backend API (`_get "$path"`) instead of limiting access to the documented queue/wait use cases. Even though requests are constrained to the fixed Sushiro API host, this still broadens capability beyond the stated skill purpose and can be used to probe undocumented endpoints or retrieve data not intended by the skill interface.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The command accepts an arbitrary backend path from the caller and appends it directly to the base API URL, enabling unrestricted access to any reachable path under `/wechat/api/2.0/`. In the context of a consumer-facing queue lookup skill, this is unnecessary and increases the risk of unintended data exposure, backend enumeration, and misuse of the embedded authorization token against endpoints outside the declared feature set.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The README states Claude will automatically invoke the skill when a user mentions broad terms like “寿司郎/排队/等位”, without describing tighter guardrails or confirmation boundaries. Broad auto-trigger conditions can cause unintended network access and execution in conversations where the user did not clearly intend to call the skill, which is risky because this skill reaches an external backend and exposes a raw passthrough capability.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The `sushiro raw <path>` command is documented as an arbitrary passthrough to `/wechat/api/2.0/<path>` without prominently warning that it performs external network requests or restricting what paths may be queried. In a skill context, this increases the chance an agent will relay user-controlled input into outbound requests, enabling unintended access to undocumented endpoints, data exposure, or misuse of the embedded bearer token.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The document embeds a live shared Bearer token and explicitly instructs consumers to use it to access the backend, which constitutes credential disclosure and facilitates unauthorized use of a third-party service. Even if the token is not user-bound, publishing reusable access credentials can enable scraping, abuse, service disruption, and potential violation of the provider's access controls or terms.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script ships with a hardcoded Bearer token used on every outbound request, which effectively redistributes a credential embedded in the code. Anyone with access to the skill can extract and reuse the token outside the intended interface, potentially enabling unauthorized API access, abuse of the upstream service, or accelerated token revocation that breaks the skill for all users.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api.md:10