T08 · Insecure Dependencies
Warning
- Location
scripts/meal_recommend.py:6- Finding
Mutable Remote Meal Data Is Downloaded Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Meal Planner
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent meal-planning skill with disclosed network use and local preference storage, but users should understand its privacy and remote-data caveats.
Install only if you are comfortable with recipe data being downloaded from GitHub/jsDelivr, your saved city being sent to wttr.in for weather, holiday lookups going to date.nager.at, and preferences such as allergies or diet goals being stored locally in user_profile.json. For stricter environments, run it in a sandbox, pre-bundle or verify the recipe JSON files, and delete user_profile.json when you do not want persistence.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared purpose emphasizes meal recommendations, but the skill also downloads remote data, calls external weather and holiday services, and persists user profile data locally. This mismatch can mislead users and reviewers about data flows and side effects, reducing informed consent and increasing privacy and supply-chain risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose emphasizes meal recommendations, but the skill also downloads remote data, calls external weather and holiday services, and persists user profile data locally. This mismatch can mislead users and reviewers about data flows and side effects, reducing informed consent and increasing privacy and supply-chain risk.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: daily-meal-planner version: "1.3.0" description: "每日智能菜谱推荐。触发词：今天吃什么/中午吃什么/晚餐推荐/下午茶/夜宵/一周菜单/清淡/辣的/快手菜/减肥。支持按餐次、口味、心情、季节、天气、地域智能推荐，带详细做法和营养数据。" --- # Daily Meal Planner 智能推荐菜谱，支持用户画像记忆和偏好学习。每餐推荐3套完整套餐（主菜+配菜+汤/主食）。 ## ⚠️ 安全与隐私说明 **网络请求**： - 首次运行时会从 GitHub/jsdelivr（官方镜像）下载菜谱数据库 - 查询 wttr.in 获取实时天�
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares no explicit tool scope or permissions despite documented use of network access and local file reads/writes. This weakens least-privilege enforcement and makes it harder for a host agent or reviewer to understand and constrain what the skill is allowed to do.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are extremely broad and map to common conversational food requests, which can cause the skill to activate unexpectedly in normal chats. Because the skill may then perform network requests and write a persistent user profile, accidental activation has privacy and consent implications beyond a simple UX issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented trigger scenarios remain ambiguous and do not define when the skill should or should not take over. In this context, ambiguity is more dangerous because activation can lead to external requests and local persistence, not just harmless text generation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
User-facing strings, prompts, usage hints, and invocation examples throughout the file are written in Chinese, including reply instructions such as replying with Chinese words and dish names. There is no indication that users can choose another language or that the skill is intentionally restricted to a Chinese-speaking locale.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill performs undeclared outbound network access for recipe data bootstrap and later for weather and holiday APIs, which expands its trust boundary beyond a local recommendation engine. This creates privacy and supply-chain risk because behavior depends on third-party services and remote content not disclosed by the manifest or obvious to users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
On startup or first load, the skill may download recipe data from remote sources and save it locally without notifying the user. Even if the content is only data, silent downloads create both privacy concerns about outbound access and integrity concerns because the local state is modified based on remote input.
- Content
Tainted flow: 'p' from open (line 61, file read) → open (file write)
Medium
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The code downloads arbitrary remote content from external mirrors and writes it directly into local JSON files used by the skill, with no signature verification, hash pinning, schema validation, or size limits. If the GitHub repository/CDN content is tampered with or a network path is compromised, the skill can be silently supplied attacker-controlled data that affects outputs and persists locally.
- Content
python for base in DATA_MIRRORS: try: from urllib.request import urlopen;d=urlopen(f"{base}/{fn}",timeout=15).read() with open(p,'wb') as f:f.write(d);return True except:continue return False def _lj(fn):
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill persists user profile data including location, food preferences, dislikes, mood, diet goal, and allergies to a local JSON file without any visible consent, retention policy, or access controls. This creates privacy risk because sensitive behavioral and health-adjacent data remains on disk and may be readable by other local users or processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatic weather lookup transmits the user's location to wttr.in without explicit warning or opt-in in this code path. Location is sensitive personal data, and sharing it with an external service for personalization can expose users to privacy harm and violate expectations or policy.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The holiday API call is not needed for meal recommendation and introduces unnecessary third-party dependency and metadata leakage such as timing and usage. While the returned data is low sensitivity, gratuitous network access increases attack surface and can surprise operators in restricted environments.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The docstring and user-facing messages/instructions in this file are entirely in Chinese, including the CLI usage output. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or explicit justification is provided.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The dependency is specified as
requests>=2.28.0, which allows installation of many future or historical 2.28+ versions without ensuring a reviewed, known-safe release. This weakens supply-chain control and can result in non-reproducible builds or accidental installation of a vulnerable version if the environment resolves to one affected by a later or existing advisory.- Content
text requests>=2.28.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Because the manifest does not pin
requeststo a specific version, there is no way to verify from this file alone whether deployment will use a release affected by known CVEs. In practice this creates uncertainty around exposure to issues such as credential leakage or other client-side HTTP flaws, especially if the skill or its support scripts make outbound network requests.- Content
Static analysis
No suspicious patterns detected.