Security audit
Security checks for vulnerabilities and agentic risk
This skill has a clear analytics purpose, but it asks the agent to use a live database credential and production-style database endpoint directly, which needs careful review before installation.
Install only if users who invoke this skill are authorized to query this APP order database and view aggregated payment/refund data. Prefer a brokered, allowlisted reporting tool over giving the agent raw mysql access and an environment-backed database password.
The activation guidance includes broad examples like “看APP各业务板块销售情况” and generic trigger words such as “按业务版块统计、APP销售情况”, which could overlap with loosely related analytics requests. Although one negative case is given for hourly queries, the skill does not clearly define the full trigger scope or additional exclusions, increasing the chance of unintended invocation.
The skill explicitly tells the agent to use a database password environment variable during execution without isolating that secret from model-controlled behavior. This creates a dangerous pattern where a prompt-accessible skill can induce credential-backed operations, increasing the risk of secret misuse, unauthorized querying, or follow-on leakage through logs, errors, or prompt injection chains.
The skill embeds a concrete production-style database hostname, privileged connection details, and instructs direct use of an environment-backed password from the agent runtime. Even if the account is read-only, exposing infrastructure connection details and encouraging the model to access credentials expands the attack surface, enables unauthorized data querying if the skill is abused, and leaks sensitive internal architecture.
The manifest description limits the skill to key indicators of 业务版块、用户数、订单量、支付金额、退款金额、净销售金额. However, the fixed SQL also produces 退款订单数、平均支付金额、最大支付金额、最小支付金额, which expands the exposed analytics beyond what the description says.
No suspicious patterns detected.
