Security audit

JD Shopping

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed JD.com shopping assistant that can prepare a cart with confirmation but repeatedly blocks login, checkout, order submission, payment, and credential storage.

Install this only if you are comfortable with an agent browsing JD.com and, after your explicit confirmation, changing cart contents in your logged-in session. You should personally handle login, CAPTCHA, address or invoice review, checkout, final order confirmation, and payment, and re-check final price and coupon eligibility yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README explicitly advertises cart modification actions ('添加商品和整理购物车') that go beyond a strictly informational or output-only shopping advisor role. Even though the document also states a checkout boundary, enabling account-state-changing actions increases the chance the agent performs unintended commerce actions in a logged-in session and creates scope ambiguity for downstream execution.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documented workflow instructs an active purchase-preparation sequence from discovery through SKU selection and cart manipulation, not merely passive analysis or formatted output. This contradiction is dangerous because users, orchestrators, or policy layers may rely on README behavior to authorize browser automation that mutates a real shopping session, weakening the declared safety boundary.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger "帮我买 Mac mini" is a natural everyday shopping request rather than a narrowly scoped invocation phrase. The README does not provide explicit trigger constraints, exclusion conditions, or a bounded activation context, so this phrasing could cause unintended skill invocation in ordinary conversation.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill provides a required boundary response entirely in Chinese for certain user requests, and additional prescribed output language appears later. There is no indication that the user may choose another language or that the Chinese-only phrasing is a documented, justified locale restriction.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file mandates use of a Chinese-language phrase for checkout/payment boundaries, but does not offer an alternative based on user preference. This can violate language/locale policy because it imposes a specific language without documented justification or user choice.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Implicit invocation allows the shopping skill to activate without explicit user intent or narrow trigger constraints. In this context, that could cause the agent to begin JD-specific shopping actions such as searching products, comparing listings, or preparing carts based on ambiguous requests, increasing the chance of unintended commercial actions and over-broad browsing in a sensitive purchase flow.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The file requires user-facing narration in Chinese, including the confirmation prompt at L068-L070 and the example phrases in the Required Narration section. This imposes a specific language on the interaction without offering the user a language choice or documenting a justified locale restriction.

Natural-Language Policy Violations

Medium

Confidence: 98% confidence
Finding: The Required Narration section specifies exact Chinese phrases the agent should say before actions. Because the policy check applies to natural-language instructions, this is a language policy issue unless the skill offers opt-in or clearly justifies a locale-specific constraint.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: The short description is written only in Chinese and the prompt is tightly bound to JD.com shopping behavior, which may impose a locale/language assumption without explicit user opt-in. The file does not indicate that users can choose another language or that the locale restriction is intentionally documented as a region-specific tool.

Static analysis

No suspicious patterns detected.