Security audit

门店销售业绩分析

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a retail sales analysis tool, but it needs Review because it loads unreviewed code from a hard-coded local path and its store-vs-clerk data scope is unclear.

Review before installing. Use only in an authorized retail BI environment, confirm that the external api_client path is trusted and controlled, and avoid clerk-level requests until the implementation has explicit clerk handling, input validation, and clear privacy guidance.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: analyze.py:13
Finding: Untrusted External Module Loaded Through a Hard-Coded Priority Search Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: analyze.py:35
Finding: Unvalidated Caller-Controlled Values Interpolated into an API Query
Content: View full analysis
Dict: """Fetch store data""" endpoint = f'/api/v1/store/dashboard/bi?storeId={store_id}&fromDate={from_date}&toDate={to_date}' return get_copilot_data(endpoint) ``` The values interpolated above originate from caller-provided parameters processed by `analyze()` at `analyze.py:235-247`, including `subject_id`, `time_window.from`, and `time_window.to`. ### Technical Analysis The function constructs an API endpoint by directly concatenating caller-controlled values into its query string. It does not validate identifier or date formats and does not apply URL encoding. A value containing query delimiters such as `&`, `=`, or `#` can change the structure or interpretation of the generated URL. For example, a crafted store identifier could append an additional parameter instead of being treated exclusively as the value of `storeId`. The exact handling of duplicate or injected parameters depends on the unavailable `get_copilot_data()` implementation and the remote API. Therefore, unauthorized access cannot be asserted unconditionally. Nevertheless, the Skill allows callers to alter the intended request structure before it reaches the API client. ### Attack Path 1. An attacker supplies crafted input to `analyze()`, such as a `subject_id` containing an encoded or literal query delimiter and an additional parameter. 2. `analyze()` passes the value to `fetch_store_data()` without format validation. 3. The f-string inserts the value directly into the endpoint. 4. The resulting URL contains attacker-selected query syntax. 5. `get_copilot_data()` sends the modified request. 6. If the API accepts duplicate parameters, trusts an injected selector, or lacks independent authorization checks, the attacker may alter ...[truncated 692 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 代码的核心目的与描述大体相关，确实是在做销售业绩环比分析、归因、异常识别和建议生成，因此不是完全无关的技能。但声明范围明显大于实际实现。fetch_store_data 固定访问 /api/v1/store/dashboard/bi?storeId=... 门店接口，analyze() 中 subject_type 虽可传 clerk，却没有任何针对导购的接口或分析分支，说明“导购个人业绩分析”并未真正实现。描述中还提到排名、业绩占比、能力雷达图、多门店/多导购对比分析，代码中均未看到相应计算或输出结构。故应判定为描述与实际能力存在实质性不一致，属于部分能力夸大。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata and code comments claim both store and clerk performance analysis, but the implementation only supports store-level retrieval and logic. This mismatch is security-relevant because callers may supply clerk identifiers or expect least-privilege clerk-scoped processing while the code actually performs store-level access patterns.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function advertises support for both store and clerk analysis, but always calls the store dashboard endpoint using the provided subject_id. This can cause incorrect data access semantics, misrouting of identifiers, and accidental exposure or processing of store-level data when the caller intended clerk-scoped analysis.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation section uses generic phrases such as “本周业绩怎么样”, “为什么销售下降”, and “业绩达标了吗”, which are common business-chat utterances rather than narrowly scoped invocation commands. The file does not provide exclusion conditions or boundary rules clarifying when these phrases should or should not activate the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill specification explicitly handles store IDs, clerk IDs, names, and backend API details without any warning, minimization guidance, or access-control expectations. In a business environment, this can normalize unsafe handling of operational and personnel data and increase the risk of unauthorized disclosure or misuse if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level natural-language description and comments present the skill as Chinese-only, without offering the user a language or locale option. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The function constructs an API endpoint using a store identifier and date range, then sends that information via get_copilot_data. While the module and function docstrings describe analysis behavior, they do not disclose that the skill transmits business data parameters to an external API, and there is no logging or prompt notifying the user of this network access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: All user-facing natural-language instructions, triggers, and examples are in Chinese, which effectively forces a single language experience. The file does not indicate that this is a region-specific skill or that users can opt into another language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.