足球篮球排球沙滩排球网球乒乓球羽毛球冰球手球水球曲棍球橄榄球棒球-球彩所有比赛全能分析助手

• Outcome: Review
• Latest audit: Aug 27, 2026 · 1:10 PM UTC
• Version: 1.0.1

Overview

This sports-reporting skill is broadly coherent, but it asks for automatic execution, broad web fetching, local file mutation, and persistent/report writes with weaker scoping than users should accept without review.

Install only if you are comfortable with a sports-report skill that can fetch public web/API data, read API keys from environment variables for sports providers, write reports to your desktop, mutate JSON files when fix/write modes are used, and store feedback locally in the browser. Prefer using explicit input/output paths, avoid the generic --url fetch for untrusted URLs, do not enable daily automation unless you want recurring runs, and avoid --write-gender unless you have reviewed the data impact.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tainted flow: 'req' from os.environ.get (line 2048, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

a.url,
                headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)",
                         "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=15) as resp:
                data = json.loads(resp.read().decode("utf-8"))
            keys = list(data.keys())[:20] if isinstance(data, dict) else []
            print("✅ 已抓取：%s" % a.url)

• Confidence: 83% confidence
• Finding: The generic fetch path accepts a user-supplied URL and performs a server-side request with urllib without any allowlist or scheme/host restrictions. In an agent skill context, this can enable SSRF-style access to internal services or unintended outbound requests if an attacker can influence --url or equivalent inputs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill directs execution of scripts that use environment variables, read and write local files, and access the network, yet it declares no permissions. This creates a trust and review gap: users and the platform are not clearly informed that the skill can fetch remote data and write artifacts to local storage such as the desktop and asset files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description frames the skill as a simple information-visualization helper, but the content instructs the agent to perform substantially broader actions: network retrieval from external sources, persistent local writes, browser-side storage, and presenting generated files. This mismatch can mislead users and reviewers about the operational risk, especially because the skill also encourages automatic execution and writes to user-facing locations like the desktop.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document states the workflow focuses on information updates and then says it does not involve pre-match information or related tracking, yet the rest of the file explicitly discusses continuous changes before kickoff such as lineups, injuries, weather, and intel. This contradiction can be used to disguise prohibited or higher-risk pre-match tracking under compliant wording, weakening policy enforcement and enabling misuse.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The compliance section claims the workflow does not perform pre-match information-change tracking, but the body of the document instructs the user to refresh and supplement exactly those changing pre-match signals. Such inconsistent compliance language may provide plausible deniability for behavior the skill actually supports, making governance and downstream safety review less reliable.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The optional --write-gender mode modifies the supplied JSON input in place, which exceeds the skill's stated information-only/reporting scope and can silently alter upstream data. In an automated pipeline, this side effect can corrupt source datasets, propagate inferred sensitive labels, and make later stages trust data that was never explicitly authored or reviewed.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script infers expected gender from sport/league names and uses that inference to validate or overwrite avatar metadata. This creates a sensitive-attribute classification mechanism unrelated to basic sports-data visualization, and errors or bias in the heuristic can mislabel people or block content based on inferred gender rather than authoritative data.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code explicitly instructs an external agent to use broader WebSearch to '补齐' data beyond the script’s direct API retrieval path. That expands the skill’s operational scope from deterministic schedule aggregation into open-ended web retrieval, which can bypass the script’s stated constraints and increase prompt-injection, source-integrity, and data-policy risks.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger logic is intentionally broad, stating that almost any phrase resembling a request for a report should immediately execute a multi-step workflow without clarification. Overbroad triggers increase the chance of unintended activation, causing unsolicited script execution, network access, and local file writes when the user may only be asking a general question.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The sample invocation phrase "分析一下今晚的曼城对阿森纳" is broad natural language that can easily overlap with ordinary sports conversation, making accidental or opportunistic triggering more likely. In a skill that discusses match analysis, such generic phrasing can cause the agent to activate in contexts beyond explicit user intent, which increases the chance of unreviewed responses or policy-boundary drift.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The documentation is entirely in Chinese and does not offer a language choice or opt-in, which can prevent some users, reviewers, or downstream agents from understanding the skill’s scope, limitations, and safety boundaries. In a security context, reduced comprehensibility can cause misuse, missed policy violations, or failure to recognize problematic behavior, even though this file does not itself contain direct exploit logic.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: When invoked with --fix, the tool overwrites the supplied JSON path in place without confirmation, backup, atomic write protection, or path safety checks. In automation or when pointed at an unexpected file or symlink, this can cause irreversible data loss or corruption of files the caller has permission to modify.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script rewrites the input JSON file directly with json.dump(open(args.path, 'w', ...)) when --write-gender is used, without confirmation, backup, or atomic write safeguards. This can overwrite original data, lose provenance, and cause accidental or irreversible changes if the flag is used in CI/CD or by downstream automation.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The hardcoded natural-language keyword heuristic enforces gender expectations such as defaulting many cases to '男' and marking leagues with certain substrings as '女'. In context, this is risky because it operationalizes policy decisions about sensitive identity attributes without user opt-in, clear justification, or locale-aware governance, and those labels can then drive validation failures or data rewrites.

Ssd 3

Medium

• Confidence: 77% confidence
• Finding: The embedded JavaScript exports all feedback stored in localStorage under a shared key without per-user scoping, retention limits, or record minimization. On a shared browser/profile, a later user could trigger export of prior users' feedback history, which is a privacy leak even if the data stays local until exported.

Static analysis

No suspicious patterns detected.