Security audit

E Store Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed marketplace installer, but it can automatically install unverified third-party tools and configurations into active agent runtimes with persistent credentials.

Review before installing. Use this only when you intentionally want marketplace search and installation, approve each package or MCP configuration before activation, inspect publisher/version/source and requested commands or endpoints, avoid non-default API origins, and treat any E_STORE_AK value as a secret that may need rotation if it appears in logs or command history.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Access Key Exposure Through URL Query Parameters and Configurable API Origin
Content: View full analysis
` (and friends as `&key=value`). ``` From `references/API.md`: ```markdown - **Base URL**：默认 `https://store-api.liganma.com`，可由 `E_STORE_BASE_URL` 覆盖。 - **认证**：通过 URL 查询参数 `ak=`（每个请求都要带）。 ``` ```http GET {baseURL}/access/product/search?ak={ak}&keyword=Spring¬InLib=true&pageNum=1&pageSize=10 GET {baseURL}/access/product/detail?ak={ak}&id=1001 GET {baseURL}/access/product/versions?ak={ak}&productId=1001&pageNum=1&pageSize=20 GET {baseURL}/access/product/download?ak={ak}&id=1001 GET {baseURL}/access/product/config?ak={ak}&id=1001 GET {baseURL}/access/product/version/config?ak={ak}&versionId=3001 GET {baseURL}/access?ak={ak} ``` ### Technical Analysis The Skill requires the `E_STORE_AK` access key to be appended to every request URL. Secrets placed in query strings are routinely exposed beyond the process that originates the request. Full URLs may be recorded by: - Origin-server and reverse-proxy access logs - CDN, gateway, firewall, and observability systems - Debugging output and exception traces - Shell history when requests are issued manually - Browser or HTTP-client history - Copied URLs and support diagnostics TLS protects the request in transit but does not prevent the URL from being retained by the receiving service or authorized infrastructure components. The risk is increased by allowing `E_STORE_BASE_URL` to override the default service origin. The reviewed instructions do not require HTTPS, validate the destination ...[truncated 1925 chars]
Remediation: View remediation
``` 2. Remove all documentation and examples that place access keys in URLs. 3. Restrict API requests to an explicit allowlist of trusted HTTPS origins. By default, permit only: ```text https://store-api.liganma.com ``` 4. If a custom `E_STORE_BASE_URL` is operationally necessary: - Require an `https://` URL. - Reject embedded credentials, unexpected ports, redirects to other origins, and non-public or loopback destinations unless explicitly authorized. - Require informed user approval before sending credentials to a non-default origin. 5. Configure clients to remove authorization data before logging requests or exceptions. 6. Ensure reverse proxies, API gateways, and monitoring systems redact existing `ak` parameters while migration is in progress. 7. Scope keys to the minimum necessary read/download permissions, issue short-lived credentials where possible, and support immediate rotation and revocation. 8. Rotate any existing key that may have appeared in URL logs and review relevant infrastructure logs for unauthorized use. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:52
Finding: Automatic Installation of Unverified Marketplace Artifacts and Configurations
Content: View full analysis
` - Solution: `solution-detail ` — and read the `products` array (the bundled resources). 4. **Pick the right download path.** Look at the chosen version's `hasFile`: - `hasFile=true` → call `product-download ` / `product-ver-download ` to get a **time-limited** download link, then fetch immediately. - `hasFile=false` → call `product-config ` / `product-ver-config ` to get a **configuration text** (e.g. an MCP server JSON). There is no file to download. 5. **Install locally.** Place the downloaded artifact / configuration into the right location for your runtime (e.g. `~/.claude/skills/`, an MCP config file, etc.). If you're inside a tool that has its own install mechanism (cc-switch, Deep Code), prefer that. After installing, **reload / restart the host tool** if the user's environment requires it, then continue with the original task. ``` From the documented solution workflow: ```markdown 1. `solution-search "小说写作"`. 2. `solution-detail ` to inspect the bundled products. 3. `solution-download ` for the whole bundle, **or** iterate the `products` array and install each via the product flow (depends on the user's preference). 4. Follow the solution's own setup notes (typically inside the bundle). ``` ### Technical Analysis Installing marketplace resources is part of the declared functionality, but the prescribed workflow moves download ...[truncated 3528 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s trigger conditions are intentionally expansive, telling the agent to invoke the marketplace whenever it lacks a capability or might otherwise write glue code. That broad activation increases the chance of unnecessary network access and acquisition of third-party artifacts in response to ordinary user requests, creating an avoidable supply-chain and overreach risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill tells the agent to obtain and use a persistent Access Key via an environment variable, enabling ongoing authenticated access across sessions. While asking the user to create their own key is not malicious by itself, encouraging persistent credential setup in a broadly-triggered marketplace skill increases the chance of overuse, unintended external calls, and accidental credential exposure or reuse.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
| `E_STORE_BASE_URL` environment variable | Optional. Defaults to `https://store-api.liganma.com`. | | Python ≥ 3.8 **or** Node.js ≥ 14 | Only if you intend to use the bundled CLI scripts. The Access API is plain HTTP GET, so you may also call it directly. | If `E_STORE_AK` is not set, **stop and ask the user** for one rather than calling the API and getting a 401 — point them to <https://store.liganma.com> to create one. ## Default workflow (5 steps)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow directs the agent to install downloaded artifacts or write configuration into local runtime locations, but does not require an explicit warning or confirmation before modifying the user’s environment. Because the marketplace can provide executable skills, MCP configs, or other active components, this creates a direct path from search results to local persistence and potential code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs clients to send the access key as a URL query parameter on every request. Query-string credentials are commonly exposed via logs, browser history, proxies, monitoring systems, and referrer leakage, so this increases the chance of credential disclosure even when HTTPS is used. In this skill context, the risk is more serious because the skill is designed for search/download/install workflows that may be automated across multiple tools and environments, multiplying places where URLs get recorded.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file title and content are presented entirely in Chinese (完整接口参考) with no indication that language selection is optional or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.