T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scraper.py:143- Finding
Arbitrary Browser Navigation Enables Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
竞品数据定时监控
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it gives a browser broad network access to user-configured URLs and can store or send captured monitoring data without enough guardrails.
Install only if you are comfortable running a browser scraper from your machine or server. Restrict task configs to trusted public platform URLs, avoid running it on networks with sensitive internal services, review webhook and email destinations carefully, disable screenshots unless needed, and prefer a virtual environment with pinned dependencies. Be cautious using install.sh with custom paths.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
install.sh:30- Finding
Unpinned Dependencies and Browser Artifacts Create Supply-Chain Risk
- Content
View full analysis
/dev/null || pip install playwright schedule requests pandas # 安装浏览器 echo "🌐 安装Chromium浏览器..." python3 -m playwright install chromium ``` Equivalent unpinned installation instructions also appear in `README.md:30-33` and `SKILL.md:386-389`. ### Technical Analysis The installation script retrieves the latest available versions of `playwright`, `schedule`, `requests`, and `pandas` without exact version constraints or package hashes. It then downloads the Chromium artifact selected by the installed Playwright version. Although the audited package names are ordinary and no suspicious package repository is configured, the installation is mutable and non-reproducible. The code reviewed during the audit may consequently run with dependency and browser versions different from those tested by the author. Python packages can execute code during installation or when imported. A compromised upstream release, package index, dependency, or browser distribution channel could therefore introduce code that was not present in the audited project. ### Attack Path 1. An upstream package, transitive dependency, package index account, or browser artifact distribution channel is compromised. 2. A malicious or vulnerable release becomes the latest version satisfying the unconstrained installation command. 3. A user runs `install.sh` or follows the equivalent documentation. 4. `pip` downloads and installs the mutable release, or Playwright downloads the selected Chromium artifact. 5. Unreviewed code executes during installation, module import, browser startup, or normal monitoring operations. ### Impact Assessment Compromised dependencies execute with the privileges of the use ...[truncated 665 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
该代码与声明中的“异常检测数据波动、爆款发现”部分是一致的，但只覆盖了整体技能描述中的一个子模块。代码没有网络访问、页面抓取、浏览器控制、定时任务、截图保存或消息通知等实现痕迹；它主要是对已提供的 current_data 与 history_data 做规则检测并生成 Alert。因此，实际行为比声明显著更窄，不能完整代表所宣称的监控型 Skill 功能，属于描述与代码行为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个完整的“竞品数据定时监控”系统，核心能力应包括定时执行、网页访问/抓取、数据分析与异常检测、截图以及告警通知。而给出的代码仅是通知子模块，负责格式化告警内容并通过邮件或机器人 webhook 发送消息。虽然代码中的告警标题、日报内容、截图附件支持与声明场景有关，但这些只是监控系统中的辅助通知功能，不能覆盖声明中的主要功能。因此，就该代码块本身而言，实际行为与声明用途存在明显不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码与描述存在明显能力不匹配。描述中核心能力包括“定时访问”“检测数据异常波动”“自动截图并发送提醒通知”，这意味着应当存在调度机制、历史数据比对/阈值分析、以及消息通知相关实现。但提供的代码仅包含页面访问、字段抓取、数字解析、可选截图、批量遍历和命令行输出，不包含任何定时器、任务调度、持久化历史数据、异常检测算法、阈值判断、告警发送（如邮件、Webhook、IM）等功能。代码确实覆盖了描述中的部分子能力，如访问页面、抓取平台指标、可选截图，但缺失了描述中的关键“监控”和“告警”能力，因此整体上属于描述大于实际行为的能力不一致。
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The script performs
rm -rf "$TARGET_DIR/$SKILL_NAME"after accepting a user-controlled installation path from$1with no validation that it points to an expected skills directory. If a user supplies an unsafe path or a symlinked location, the installer can recursively delete unintended files or directories, causing destructive data loss.- Content
sh echo "安装已取消" exit 0 fi rm -rf "$TARGET_DIR/$SKILL_NAME" fi # 创建目录并复制
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly promotes automated scraping, screenshots, local storage, and outbound notifications, but it does not clearly warn users that the skill may collect and persist third-party content and transmit captured data externally. In a monitoring/scraping skill, these behaviors materially affect data handling and privacy/compliance risk, so omission of an explicit warning can lead to unsafe deployment or misuse.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python scripts/monitor_service.py start --config assets/config/monitor_tasks.json
后台运行
nohup python scripts/monitor_service.py start > monitor.log 2>&1 &
text ### 4. 单次测试
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python scripts/monitor_service.py start --config assets/config/monitor_tasks.json
后台运行
nohup python scripts/monitor_service.py start > monitor.log 2>&1 &
text ### 4. 单次测试
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities requiring network access, file reads/writes, and shell execution, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged and under-specified execution model where an agent or runtime may allow broader actions than a user expects, increasing the chance of misuse or unintended data access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest sets
language: zh-CN, and the rest of the skill content is presented only in Chinese without indicating that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified as region-specific.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill supports sending alerts through third-party webhook and email services but does not prominently warn that monitored URLs, page-derived metrics, and possibly screenshots may be transmitted off-platform. This creates a real data disclosure risk, especially in competitor-monitoring contexts where target lists and trend data may be commercially sensitive.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # 设置权限 echo "🔧 设置权限..." chmod 755 "$TARGET_DIR/$SKILL_NAME" chmod -R 755 "$TARGET_DIR/$SKILL_NAME/scripts" echo ""
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation and console output in Chinese only, starting with the module docstring and continuing throughout the CLI experience. Under the policy, forcing a specific language without offering a language/locale choice is a natural-language policy violation.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 读取最近几天的数据 for i in range(days): date_str = (datetime.now() - __import__('datetime').timedelta(days=i)).strftime('%Y-%m-%d') data_file = task_dir / f'{date_str}.jsonl' if data_file.exists():
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains module documentation and operational messages entirely in Chinese, and the generated notification titles/content are also hard-coded in Chinese. That creates a language/locale constraint without user opt-in or documented justification, which matches the policy-violation criterion for forced language selection.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } } response = requests.post(url, json=data, timeout=30) result = response.json() if result.get('errcode') == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } } response = requests.post(self.webhook, json=data, timeout=30) result = response.json() if result.get('code') == 0:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python } } response = requests.post(self.webhook, json=data, timeout=30) result = response.json() if result.get('code') == 0:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code visits arbitrary user-supplied URLs, extracts page content, and can capture full-page screenshots, which may include personal or sensitive information. While the operations are part of the scraper's purpose, the code provides no explicit disclosure about privacy implications or what data may be collected and stored.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Automatic screenshot capture and local retention can store sensitive page content, account context, or proprietary monitoring targets without sufficiently clear user warning. While not an exploit by itself, this increases privacy and information-retention risk if the host is shared, compromised, or misconfigured.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest-style JSON includes user-facing task names such as "竞品抖音视频-爆款监控" and similar Chinese-only labels across the file, but does not indicate that the skill is intentionally limited to a Chinese-language or region-specific workflow. That can violate language/locale policy if users are not given an opt-in or choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill file, including headings, operational notes, and examples, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation and output strings exclusively in Chinese, beginning with the module docstring and continuing throughout the file. Under the policy, forcing a specific language without user opt-in or a documented justification is a language/locale policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Alert text such as anomaly descriptions is hard-coded in Chinese, which enforces a single locale for end users. The file does not expose any mechanism to select language or explain why Chinese-only output is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The sample runtime output shown in the main entrypoint is presented only in Chinese, which reflects a fixed-language user interaction pattern. There is no opt-in, fallback language, or documented regional limitation to justify the restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
User-facing docstrings, warnings, CLI descriptions, and status messages are presented exclusively in Chinese, which effectively forces a specific language without offering the user an option. The file does not indicate that the tool is intentionally region-specific or provide any locale-selection mechanism.
- Content
Static analysis
No suspicious patterns detected.