OPC赛事活动追踪

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:39 AM UTC
• Version: 2.3.0

Overview

The skill has a clear event-tracking purpose, but it needs Review because unsafe defaults and unbounded configuration can publish scraped data or send an API key outside the intended service.

Review this before installing. Use it only if you are comfortable storing an OPC API key locally and publishing event data to a public pool. Keep upload_enabled set to false unless you explicitly want publication, keep api_base fixed to https://mrkjai.com, and only add trusted HTTPS event sources after reviewing what will be fetched and submitted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/track_events.py:56

Finding

Unrestricted source fetching enables SSRF and external data relay

Content

View full analysis

{e}") return None ``` Configured source URLs are passed directly to this function: ```python for source in sources: if not source.get("enabled", True): print(f"\n⏭️ 跳过：{source['name']}") continue print(f"\n🔍 抓取：{source['name']} ({source['url']})") html = fetch_url(source["url"]) if not html: print(f" ❌ 抓取失败") continue print(f" ✅ 抓取成功，{len(html)} 字符") parser = PARSERS.get(source["id"]) if not parser: print(f" ⚠️ 无解析器，使用通用解析") text = extract_text(html, 5000) title_match = re.search(r"(.*?)", html, re.IGNORECASE | re.DOTALL) title = title_match.group(1).strip() if title_match else source["name"] events = [{ "id": make_id(source["id"], title), "source_id": source["id"], "name": title, "summary": text[:300], "type": source.get("category", "未知"), "organizer": source.get("organizer", ""), "status": "未知", ...[truncated 3657 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/track_events.py:164

Finding

Unvalidated API base URL can disclose the user API key and event data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/track_events.py:618

Finding

Missing upload setting defaults to consent being granted

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list is broad and includes common conversational words like '赛事', '比赛', and '活动', which can cause the skill to activate during ordinary discussion rather than explicit user intent. In this skill, unintended activation is more dangerous because it can lead to scraping external sources and submitting structured data to a public OPC pool, creating unexpected outbound actions and possible privacy or consent issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description states that extracted event information will be submitted to an 'OPC 公共赛事池' but does not present a clear warning, consent notice, or explanation of what data leaves the local environment. This is risky because users may think they are only organizing or summarizing events locally, while the skill performs a public or external data-sharing action that could expose sensitive notes, proprietary event details, or unintended metadata.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill clearly describes capabilities to read and write local files and make outbound network requests, but it does not declare any explicit tool scope or permission boundary. This creates an authorization ambiguity where the runtime may grant broader access than users or reviewers expect, increasing the risk of silent data exfiltration or unintended file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill defines very broad triggers such as '赛事', '比赛', and '活动', which can match ordinary conversation and invoke a workflow that reads local config, fetches remote content, and may submit data externally. Because this skill can perform network operations and write local state, accidental activation materially increases the chance of unintended data transmission or state changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The xiaping_trigger list includes broad terms, including '活动' and especially 'OPC', which are likely to appear in unrelated user requests. In this skill, false activations are more dangerous than normal because activation can lead to external API calls, local file writes, and optional uploads to a public event pool.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The document explicitly directs sending data and an API key to an external domain via POST. In the context of an agent skill, any external transmission of user-provided credentials and scraped content is security-relevant because it creates a path for data egress and potential misuse if users are not clearly informed or if the endpoint is not adequately trusted and scoped.

Content

Scanner excerpt · references/api-spec.md (reported line 70)May include surrounding context.

3. 调用示例

bash

curl -s -X POST 'https://mrkjai.com/api/events/ingest' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: opc_user_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow instructs the agent to scrape a third-party event page and submit structured data plus the user's API key to an external production endpoint, but it does not require explicit user notice or confirmation at the moment of transmission. In an agent setting, silent outbound transmission can violate user expectations and privacy boundaries, especially when credentials and extracted content are sent off-platform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L151-L152 指示在抓不到时间信息时用当前时间或 publishedAt + 30 天 兜底生成字段值，而 L179-L182 又声明“不要做的事”包括不猜测/伪造信息。对于 extracted event ingestion 这类技能，自动编造缺失的关键时间字段与“不要猜测/伪造”的说明存在直接意图冲突，可能导致代理提交并非源页面真实提供的赛事信息。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill specification is written only in Chinese, including headings, field descriptions, and instructions, with no indication that language choice is optional or that the skill is intentionally restricted to Chinese-speaking users. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale-policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically uploads newly scraped event data to a public OPC endpoint whenever upload_enabled is true and an API key is present, without an explicit confirmation at the moment of transmission. In this skill context, the data is scraped from external sources and may include inaccurate, unwanted, or policy-sensitive content, so silent forwarding to a third-party service creates a real data-governance and consent risk.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 79% confidence

Finding

The trigger '赛事' is extremely short and generic, making accidental invocation likely. In this skill's context, even low-precision triggering matters because activation may result in outbound queries or prepare uploads to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

文件中的名称、描述、安装引导、触发词和交互文案均默认要求中文表达，例如使用固定中文指令如“关闭赛事上传”“配置赛事上传”。文档未说明是否支持其他语言，也未给用户提供语言/地区选择，存在语言策略上的强制默认。

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 79% confidence

Finding

The trigger '比赛' is overly broad and may match many unrelated user messages. Given this skill's ability to fetch data, read config, and interact with a remote API, broad matching increases the risk of unintended execution paths.

Content

No source excerpt is available for this finding.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 80% confidence

Finding

The trigger '活动' is a common everyday word and can cause false activation in unrelated contexts. Because the skill is not purely informational and can persist data or contact a remote server, this ambiguity creates a real though lower-severity security risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions, field descriptions, examples, and workflow guidance are presented only in Chinese, and the document does not indicate that the skill is region-specific or that users may choose another language. This can be a natural-language policy issue when a skill effectively forces a language/locale without opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L156-L171 明确给出 type、region 乃至 deadlineAt 的推断与默认值规则，表明该技能不仅做“提取”也会做缺失信息补全；而 L179-L180 又强调不要猜测/伪造部分字段。虽然禁令只点名 title 和 organizer，但整体文档对“可否推断并提交非源数据”给出了不一致信号，容易让实现偏离“抓取并提交真实赛事信息”的原始意图。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file instructs the operator to edit sources.json and track_events.py, which affects project data and code. The guidance does not include any warning or note that these steps modify files in the repository, so users may not be explicitly alerted to the impact of following the instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level docstring and all user-facing output are written in Chinese, and the file does not indicate that language selection is optional or region-specific. Under the policy, hard-coding a specific language without user opt-in is a natural-language locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-spec.md:72