薅羊毛助手

• Outcome: Review
• Latest audit: Jul 18, 2026 · 9:27 AM UTC
• Version: 1.0.1

Overview

This shopping-deals skill is mostly coherent, but it sends searches and bearer tokens to external Coze endpoints while using broad triggers and forced promotional/contact messages that users should review before installing.

Install only if you are comfortable sending product searches and deal requests to Coze APIs and managing your own Coze tokens. Treat the token as a secret, avoid untrusted COZE_BASE_URL or coze_api_url values, and expect the skill to add promotional/contact text to normal and error responses.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'req' from os.environ.get (line 69, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

answer_parts = []

    try:
        with urllib.request.urlopen(req, context=ctx, timeout=60) as resp:
            # 逐行读取 SSE 流
            for line in resp:
                try:

• Confidence: 86% confidence
• Finding: with urllib.request.urlopen(req, context=ctx, timeout=60) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents network access and use of environment/config-stored credentials, but no corresponding permissions are declared. This creates a transparency and governance gap: users and platforms cannot accurately assess that the skill sends queries and tokens to external services, increasing the risk of unexpected data egress and secret misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior exceeds the stated coupon-search purpose by requiring promotional lead-generation content on every response and by exposing a generic remote Bot caller that can send arbitrary user text to an external service. This mismatch undermines informed consent and broadens the skill into a general-purpose external relay, which increases privacy, abuse, and policy-evasion risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: Mandating promotional content in every output is unrelated to the core shopping-assistant function and turns the skill into a persistent marketing channel. This can manipulate users, create unwanted external redirection, and indicates hidden operator objectives beyond the declared utility.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Directing users to contact a personal WeChat account and join a group when errors occur introduces unjustified off-platform lead capture and social-engineering risk. Error flows should not be used to funnel users to personal contact channels, especially in a utility skill handling external API interactions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script appends fixed promotional content and an external group/join link to output regardless of the user's request. This creates undisclosed user-acquisition behavior outside the stated coupon-search function and can redirect users to third-party destinations they did not explicitly request.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: On error, the code returns a hardcoded message directing users to contact a personal WeChat account and join a promotional group. This introduces off-platform user diversion unrelated to core task fulfillment and can be used for lead capture, phishing, or social engineering if the operator or account changes.

Context-Inappropriate Capability

Low

• Confidence: 97% confidence
• Finding: The script unconditionally prints promotional content and an external group/join link after performing the requested coupon search, which is unrelated to the stated search functionality. While this is not code execution or direct data theft, it is deceptive UX and creates unsolicited traffic redirection that could expose users to tracking, spam, or social-engineering risks.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The triggers are broad shopping-related phrases that can match ordinary user requests, causing the skill to activate more often than intended. In this skill, that is more dangerous because activation can lead to network calls, external data transmission, and forced promotional output without clear user intent.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The example trigger patterns like '有没有XX的优惠' and 'XX哪里买最便宜' are ambiguous and overlap with normal conversational shopping questions. Because the skill performs remote lookups and appends branding, ambiguous activation increases the chance of unintended data sharing and unsolicited promotion.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to store API tokens in a config file and environment variables without warning that these are sensitive secrets or providing handling precautions. This can lead to accidental token exposure, insecure local storage, and unauthorized use of the linked external service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: User search terms are sent to a third-party Coze API, but the script provides no clear user-facing notice at runtime that their queries leave the local environment. Because coupon searches can contain shopping intent, product interests, or other personal preference data, this creates a privacy and transparency issue, especially in a skill positioned as a unified search tool.

External Script Fetching

Low

• Category: Supply Chain

Content

### 环境依赖

- Python ≥ 3.11
- `uv`（跨平台 Python 包管理器）：`curl -LsSf https://astral.sh/uv/install.sh | sh` 或 `pip install uv`
- 配置文件 `~/.coupon_search_config.json`（含 `coze_api_url` 和 `coze_api_token`）

## 使用

• Confidence: 96% confidence
• Finding: curl -LsSf https://astral.sh/uv/install.sh | sh

External Script Fetching

Low

• Category: Supply Chain

Content

## 前置依赖

- `uv`（跨平台 Python 包管理器，安装：`curl -LsSf https://astral.sh/uv/install.sh | sh`，或 `pip install uv`）
- `美团生活助手` 技能（本地生活场景，可选）
- `~/.coupon_search_config.json`（电商搜索配置）
- `COZE_TOKEN` 环境变量（羊毛福利查询）

• Confidence: 79% confidence
• Finding: curl -LsSf https://astral.sh/uv/install.sh | sh

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 83% confidence
• Finding: The trigger '搜券' is so short and generic that it may match unintended requests. In this skill, accidental activation is not harmless because it can initiate external queries and append unrelated promotional content.

Overly Broad Trigger

Low

• Category: Trigger Abuse
• Confidence: 84% confidence
• Finding: The trigger '比价' is a generic phrase likely to overlap with ordinary discussion. Because the skill performs remote lookups across multiple platforms, this broad trigger can cause unintended invocation and unnecessary sharing of user queries with external services.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.