Security audit

Silver Price Inquiry - 白银价格查询

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed silver-price lookup skill that calls a third-party market data API and does not show hidden, destructive, or persistent behavior.

Before installing, make sure you are comfortable giving this skill access to a JisuAPI AppKey and sending silver-price query parameters to JisuAPI. The code should be corrected to send the constructed appkey parameters before it will reliably return authenticated results.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code is largely aligned with the declared domain: it is clearly a silver-price skill and includes Shanghai market and London silver endpoints consistent with the description. However, there are two notable mismatches. First, it exposes an additional capability for historical silver行情查询 (history with market/startdate/enddate/type), which is not declared. Second, _call_silver_api builds all_params including appkey and filtered parameters, but mistakenly calls requests.get(..., params=params, ...) instead of params=all_params. That means the authentication key is omitted from outbound requests, so the implemented behavior likely does not actually retrieve the declared live pricing data successfully. This is a material behavior discrepancy, though the intended purpose remains similar.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares access to an environment variable and relies on an external API, but it does not declare an explicit tool scope such as allowed tools or permissions. This creates a governance gap where an agent may invoke networked code and access secrets without clear policy boundaries, increasing the chance of unintended secret use or over-broad execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation guidance includes specific examples, but then expands to any “similar silver price question,” which is ambiguous and may overlap with ordinary conversation about silver markets. The file does not provide exclusion conditions or a clear scope for what counts as similar enough to invoke the skill.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · silver.py (reported line 14)May include surrounding context.
python
import requests BASE_URL = "https://api.jisuapi.com/silver" def _call_silver_api(path: str, appkey: str, params: dict = None):

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The helper constructs an authenticated parameter set in all_params but sends params=params to requests.get, omitting the API key and any filtered parameters. This creates a security-relevant integrity flaw: the implementation does not match the intended authenticated design, causing failed or unexpected requests and potentially encouraging insecure workarounds such as hardcoding credentials elsewhere or disabling checks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The module docstring includes Chinese-language descriptive text and the CLI help/output comments are also partly Chinese, but the file does not indicate any user language selection or opt-in. This can create a locale-policy issue if the skill effectively assumes a specific language without documenting that constraint or offering alternatives.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code sends a network request to an external API, which necessarily transmits request metadata and intended query parameters off-box. Although the file has a general module docstring and CLI usage text, there is no user-facing warning or runtime disclosure near the request itself describing that external transmission occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.