T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:3- Finding
Authenticated account operations exceed the declared no-login boundary
- Content
View full analysis
- Remediation
View remediation
Security audit
Alibaba Shopping Assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a shopping assistant, but it advertises a no-login boundary while instructing agents to use logged-in shopping sessions for cart, coupon, address, and order-preview actions.
Review this skill carefully before installing. It is not just a public product-comparison helper as described; it may guide an agent to use your logged-in Alibaba/Taobao/Tmall session, inspect cart and address details, add items, apply coupons, and prepare an order preview. Do not install unless you are comfortable with those account-level actions and can supervise each step before any cart, coupon, address, or checkout-related change.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The top-level description promises a safe boundary of no login, no order submission, and no payment, yet the body of the skill instructs the agent to operate in logged-in sessions for cart and pre-order tasks. This mismatch can mislead operators and downstream policy systems into treating the skill as safer than it is, increasing the chance of unauthorized account actions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill’s stated safety boundary says no login, no order submission, and no payment, but the workflow explicitly instructs the agent to add items to cart, apply coupons, select an address, and generate an order preview. This creates a dangerous policy contradiction that could cause an agent to access authenticated commerce flows and perform purchase-adjacent actions beyond the advertised boundary.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The later safety sections forbid entering addresses, using credentials, and submitting orders, but earlier sections direct the agent to use an active logged-in session, add items to cart, apply coupons, and select an address during order generation. Contradictory instructions in a commerce automation skill are hazardous because an agent may follow the more operationally specific steps and cross into sensitive account and transaction workflows.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly documents login-required operations such as shopping cart access, coupon application, address selection, and order generation, which contradict the stated skill boundary of 'no login, no order submission.' Even if payment is deferred to the user, enabling authenticated pre-purchase actions materially expands the agent's authority and can cause unauthorized account actions, privacy exposure, and progression toward a transaction.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Phase 3 gives step-by-step instructions to add items to cart, view cart contents, apply coupons, select delivery address, calculate totals, and generate an order preview after checking login status. These are concrete authenticated shopping actions that exceed the declared safe boundary and could manipulate a user's account state or expose sensitive personal information such as saved addresses and payment options.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The order summary template and payment instructions are written entirely in Chinese, and the document does not state that the skill is limited to Chinese-speaking users or provide an opt-in language choice. This can violate language/locale policy because it imposes a specific language on users by default.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest description says 'Input a buying need or product link' but does not define specific trigger phrases, activation scope, or exclusion conditions. In a manifest file, this kind of broad natural-language invocation can overlap with many ordinary shopping-related requests and may cause unintended skill activation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This markdown file is almost entirely written as prescriptive guidance in English, including recommendation logic and final rules. Under the policy provided, forcing a specific language without user opt-in can be a natural-language policy violation, and the file does not indicate that English is optional or region-justified.
- Content
Static analysis
No suspicious patterns detected.