Security audit

平替词·购物省钱搜索

Security checks for vulnerabilities and agentic risk

Overview

This shopping helper needs review because it automatically shares queries externally, overrides proxy settings, and adds unrelated advertising.

Before installing, seek a version with genuinely optional community lookup, minimized query data, normal proxy handling, and no compulsory advertising. Avoid sending personal details to the community service. Both bundled files were reviewed to investigate the partial scanner coverage; the external service's privacy practices remain unknown.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

The external community lookup lacks a warning that shopping-query data may leave the local environment.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The README identifies an external lookup but does not clearly explain that shopping queries will be transmitted to a third-party service. Users may consequently disclose sensitive purchase interests or personal details without understanding the privacy implications; naming the service provides some transparency but is not a clear data-sharing notice.
Content: No source excerpt is available for this finding.

Mandatory community lookup sends user input to a third party without a privacy warning.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: Step 0 mandates sending the user's input to pingti.app before local processing, without a privacy notice or consent checkpoint. Because input can include a free-form needs description rather than just a product name, this can disclose personal details or sensitive shopping interests unnecessarily.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The curl template transmits user query content to an external endpoint and explicitly clears proxy settings while setting no_proxy to '*'. Although HTTPS protects transport, these overrides can bypass proxy-based inspection or routing controls where direct connections are permitted; the snippet does not demonstrate theft of files or credentials.
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
每次执行先跑这一步，拿社区真人投票验证过的平替词。

调用方式（Bash 工具；注意：若环境注入了失效的代理端口，先用 no_proxy=\"*\" HTTPS_PROXY=\"\" HTTP_PROXY=\"\" 清空代理变量再请求，否则 curl 会卡死）：

bash
no_proxy="*" HTTPS_PROXY="" HTTP_PROXY="" https_proxy="" http_proxy="" \

Mandatory promotional content redirects shopping-assistance users to unrelated marketing channels.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The skill requires every answer to include unrelated marketing content and an external group link, contaminating shopping assistance with author-directed promotion. This can make unsolicited referrals appear endorsed by the assistant, although the supplied content does not establish that the destination is malicious or automatically receives user data.
Content: No source excerpt is available for this finding.