北京住宅全信息助手 (房价/学区/交通)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:28 AM UTC
• Version: 1.0.8

Overview

The skill mostly matches its Beijing housing and school-lookup purpose, but it needs Review because it launches an unsandboxed browser against an HTTP site and submits community or address data without clear user consent.

Install only in an isolated virtual environment or container under a low-privilege account. Do not submit a precise home address unless you are comfortable sending it to the referenced external education site, and prefer manual browser verification where possible. The publisher should pin dependencies, remove --no-sandbox, prefer HTTPS-verified official endpoints, and add a clear privacy prompt before automated lookups.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

beautifulsoup4== selenium== ``` 2. Generate and commit a lock file that includes resolved transitive dependencies. 3. Add cryptographic hashes and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Install dependencies from a trusted, explicitly configured package index. 5. Run dependency vulnerability and provenance checks in CI before accepting updates. 6. Update `SKILL.md` so its installation command uses the reviewed requirements or lock file rather than installing unrestricted package versions directly. 7. Perform installation and execution in an isolated virtual environment or container under a non-privileged account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query_school_browser.py:16

Finding

Sandboxed Browser Isolation Disabled While Loading a Plaintext HTTP Page

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose promises comprehensive housing information including price, district, and transport, but the described behavior appears incomplete or focused on a narrower school-zone workflow. Security-sensitive systems depend on accurate capability declarations; when a skill materially overstates or misstates what it does, users and operators cannot make informed trust decisions and may act on false assumptions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The documented purpose promises comprehensive housing information including price, district, and transport, but the described behavior appears incomplete or focused on a narrower school-zone workflow. Security-sensitive systems depend on accurate capability declarations; when a skill materially overstates or misstates what it does, users and operators cannot make informed trust decisions and may act on false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs the agent to run local Python scripts, install dependencies, and access external websites, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where the skill's effective capabilities are broader than its declared contract, increasing the chance of unintended file access or network use without proper review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction mandates that all results include a fixed Chinese statement: "信息来源于 2025 年官方公开资料...". This is a natural-language locale policy constraint because it requires a specific language for output without stating that the user can choose another language or that the locale restriction is necessary for compliance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script types a user-supplied community or address into a live third-party government website via Selenium, which transmits potentially sensitive location information off-platform. The code does not provide any inline warning, consent check, or minimization step before sending the data, so users or upstream agents may disclose precise residential information without realizing it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'requests' is unpinned, so installs may resolve to different versions over time, making builds non-reproducible and potentially pulling in a vulnerable or breaking release. In a skill that performs network access and external verification, dependency drift increases supply-chain risk even if no specific exploit is guaranteed from this file alone.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests
beautifulsoup4
selenium

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest includes 'requests' without a version pin, and that package has multiple known advisories across releases. Because the installed version is unspecified, there is a real risk that deployment could resolve to an affected version, which is especially relevant for a skill that makes outbound HTTP requests and may handle redirects, authentication material, or remote content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency 'beautifulsoup4' is unpinned, which allows uncontrolled version changes during installation. This creates reproducibility and supply-chain integrity issues and can introduce security regressions or incompatibilities without any code change.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests
beautifulsoup4
selenium

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'selenium' is unpinned, so future installs may pick up unexpected versions with known flaws or behavior changes. This is somewhat more sensitive here because Selenium commonly drives browsers and interacts with untrusted web content, increasing exposure if a bad version is installed.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests
beautifulsoup4
selenium

Unverifiable Dependency: selenium has 2 known advisory(ies) (CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content ); CVE-2023-5590 (NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The manifest includes 'selenium' without a version pin even though known advisories exist in some releases. Since Selenium automates browser activity against external sites, leaving the installed version undefined creates avoidable exposure to known flaws and makes it impossible to verify whether deployments are patched.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The note field is written entirely in Chinese and does not indicate that the content is intentionally limited to Chinese-language users or a China-specific workflow. Under the policy rule, forcing a specific language without user opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.