Security audit
Security checks for vulnerabilities and agentic risk
This shopping skill is mostly disclosed but needs review because it advertises a no-login boundary while its workflow can use a logged-in Pinduoduo account, change cart/group-buy state, enter checkout preview, and expose address data.
Install only if you are comfortable with an agent potentially using an already logged-in Pinduoduo session, changing cart or group-buy state, applying coupons, and seeing checkout-preview details. Keep use to public browsing/product evaluation unless you give explicit action-by-action consent, and do not let it proceed into checkout or handle address, order submission, or payment screens.
references/browser-workflow.md:55Authenticated account access and state-changing commerce actions exceed the declared read-only scope
The manifest claims a safe boundary of 'no order submission, no payment,' but the body permits state-changing commerce actions including add-to-cart, initiating or joining 拼团, applying coupons, and generating order previews. On PDD, joining or initiating a group buy may create commitments or advance the transaction flow, so the top-level safety claim understates the real capability and can mislead orchestration layers or users.
The documented supported operations include Add to Cart, View Cart, Initiate/Join Group, Apply Coupons, and Generate Order Preview, which go beyond the skill's declared evaluation-only boundary of 'no login, no order submission, no payment.' This creates a capability mismatch that could lead an agent to perform transactional or account-scoped actions the user did not expect, increasing the risk of unauthorized commerce actions and privacy exposure.
The workflow explicitly instructs login-dependent actions such as clicking add-to-cart, initiating or joining a group, navigating to the cart, and proceeding to checkout for an order preview, despite the manifest stating a 'no login' safety boundary. In an agent setting, this contradiction is dangerous because implementation often follows the more detailed workflow, enabling account-affecting actions and movement toward purchase completion.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Common Traps
- **Joining any group without checking seller** → Quality varies wildly
- **Ignoring shipping times** → Can be 5-10 days
- **Assuming 百亿补贴 = always authentic** → Still verify seller
- **Not reading 1-star reviews** → Pattern of issues
The skill defines 'When login is required (ask first)' as a stop condition, but elsewhere explicitly authorizes proceeding with logged-in actions such as viewing carts, joining groups, and applying coupons after consent. This contradiction can cause an agent to misinterpret safety boundaries and continue into authenticated commerce flows that materially change the user's account state.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- ❌ Recommend sellers with rating <4.5
- ❌ Store user data persistently
- ❌ **Execute payment or final order submission**
- ❌ Guarantee 百亿补贴 authenticity without verification
## Related Skills
Claiming 'clear safety boundaries' while the same document includes contradictory transactional and login-required flows is a misleading safety assertion. This is not just wording drift: it can reduce operator vigilance and cause downstream agents or reviewers to trust the skill more than warranted, making the boundary violations elsewhere more likely to be executed.