T08 · Insecure Dependencies
Error
- Location
compare.py:11- Finding
Unsafe External Module Resolution Through Prepending Hard-Coded Import Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
SKU对比分析
Security checks for vulnerabilities and agentic risk
Overview
This retail SKU analytics skill appears purpose-aligned, but it loads unreviewed local Python modules through hard-coded paths before running business-data queries.
Review this skill before installing. It is not showing destructive or deceptive behavior, but it should remove hard-coded external import paths, package or pin its dependencies, drop the unused external skill import, validate and URL-encode API parameters, and clearly disclose that it queries backend store/SKU/clerk performance data.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
compare.py:30- Finding
API Query Parameter Injection Through Unencoded Caller-Controlled Values
- Content
View full analysis
Dict: """获取单SKU基础数据""" endpoint = f'/api/v1/store/dashboard/bi/goods/detail?storeId={store_id}&fromDate={from_date}&toDate={to_date}&goodsBaseId={goods_base_id}' return get_copilot_data(endpoint) def fetch_sku_performance(store_id: str, goods_base_id: str, from_date: str, to_date: str) -> Dict: """获取单SKU导购表现数据""" endpoint = f'/api/v1/store/dashboard/bi/goods/performance?storeId={store_id}&fromDate={from_date}&toDate={to_date}&goodsBaseId={goods_base_id}' return get_copilot_data(endpoint) ``` ### Technical Analysis The functions interpolate caller-controlled `store_id`, `goods_base_id`, `from_date`, and `to_date` values directly into URL query strings. They do not validate the expected formats or URL-encode the values. An input containing query delimiters such as `&`, `=`, or `#` can change the structure or interpretation of the request. For example, a crafted identifier could append another query parameter rather than remaining a single `storeId` value. Duplicate-parameter behavior varies by the API server and client implementation, but may permit an attacker to override or supplement intended parameters. The final effect also depends on the behavior of the externally imported `get_copilot_data()` function and the server's authorization controls. The audited code confirms unsafe request construction, but does not establish that backend authorization can necessarily be bypassed. ### Attack Path 1. An untrusted caller invokes a public comparison function with a crafted value, such as a `store_id` containing `&additionalParameter=value`. 2. The value is interpolated verbatim into the endpoint string. 3. `get_copilot_data()` sends or process ...[truncated 1116 chars]- Remediation
View remediation
str: datetime.strptime(value, "%Y-%m-%d") return value def fetch_sku_data( store_id: str, goods_base_id: str, from_date: str, to_date: str ) -> Dict: params = { "storeId": store_id, "fromDate": _validate_date(from_date), "toDate": _validate_date(to_date), "goodsBaseId": goods_base_id, } endpoint = ( "/api/v1/store/dashboard/bi/goods/detail?" + urlencode(params) ) return get_copilot_data(endpoint) ``` 3. Prefer an API client method that accepts a separate `params` dictionary and performs encoding internally. 4. Enforce authorization on the server for every requested store and SKU; do not rely on client-side validation as an access-control boundary. 5. Define and reject duplicate or unknown query parameters at the backend. 6. Add tests using values containing `&`, `=`, `#`, percent-encoding, Unicode delimiters, malformed dates, and oversized identifiers. ]]>
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The markdown lists trigger conditions such as comparing SKUs, analyzing SKU changes, or asking for rankings, but it does not define clear boundaries for when this skill should activate versus other analytics skills. Phrases like '这个款比上月怎么样' are generic in retail conversation and no exclusion cases or context limits are provided.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill modifies sys.path to import a local module from an unrelated skill directory, creating an unnecessary trust boundary expansion and hidden dependency on code outside this skill. Even though the imported module is not used in this file, this pattern can execute unreviewed module top-level code at import time and makes the skill's behavior dependent on external local content that may be changed independently.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The helper functions build API endpoints containing store and product identifiers and immediately call
get_copilot_data, which implies network access to business data. Although some progress prints exist elsewhere, there is no explicit warning, confirmation, or comment disclosing that the skill will contact backend services and process potentially sensitive operational data.- Content
Static analysis
No suspicious patterns detected.