十元云铺万元利

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:09 AM UTC
• Version: 0.3.2

Overview

This skill is a disclosed paid cloud storefront generator, but users should understand that product details and contact QR codes are sent to and published by an external hosted service.

Install only if you are comfortable with a paid cloud service that uploads product descriptions/images and optional phone, WeChat, or QR-code contact details to ruancyai.com and publishes them on shareable pages. Confirm the ¥9.9 charge before creating a shop page, and avoid uploading sensitive personal, payment, or business information unless it is meant to be public.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The changelog shows the skill evolved from a display-only lead-generation tool into a payment-gated workflow with order creation, payment verification, callbacks, status checks, and refunds. That materially contradicts the declared scope that the platform does not participate in transactions, creating a dangerous mismatch between user/operator expectations and the actual financial behavior of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Refund, callback, and payment-status endpoints are high-risk financial operations that are not justified by a skill whose stated purpose is merely generating a shareable showcase page. Unnecessary financial capabilities enlarge the attack surface for payment abuse, unauthorized state changes, and backend compromise, especially because the business context says transactions should occur offline.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user skill for generating a mini product sales page hosted at ruancyai.com/cloud from a sentence or image. The actual code does not implement any of those functions. Instead, it is an internal developer/package compliance validator for the skill bundle, focused on file presence, binary detection, version checks, disclaimer enforcement, and self-tests. This is a materially different primary purpose, not merely a supporting detail of the declared skill behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The changelog introduces payment, refund, and payment-status endpoints without any explicit warning that these operations can trigger real financial effects. In a skill ecosystem, documenting such capabilities without clear risk labeling increases the chance that integrators or agents treat them as routine API calls rather than money-moving operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The changelog states the skill is charged per call, but this file does not provide a clear user-facing warning about paid usage or billing impact at the point where the pricing change is introduced. For an agent-invoked skill, inadequate disclosure can lead to non-consensual charges, user deception, and unsafe automated invocation of paid actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This packaging guide uses Chinese throughout, including headings and operational instructions, and does not indicate that the language is optional or limited to a justified Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to upload product photos, text descriptions, and optional QR codes, while also naming a remote production backend, but it does not clearly disclose that this user-provided content will be transmitted to an external service for processing and hosting. This can mislead users about where sensitive business or personal contact data goes, increasing privacy and consent risk, especially because QR codes and contact details may contain personally identifiable information or payment identifiers.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad enough to match ordinary selling, page-building, or product-description requests, which can cause the skill to activate in situations where users did not intend to invoke an external commerce workflow. Because this skill sends user-provided product data and contact details to a remote service and may initiate a paid flow, overbroad triggering increases the risk of unintended data disclosure and surprise charges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill asks users to provide product images and contact information and instructs the agent to call backend APIs, but it does not prominently warn users that these materials will be transmitted to external services. This is dangerous because users may unknowingly disclose personal phone numbers, WeChat IDs, or business-sensitive product imagery to third-party infrastructure without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

后端 createNativeOrder() 调用微信支付 Native 下单接口获取 code_url：

text

POST https://api.mch.weixin.qq.com/v3/pay/transactions/native
Authorization: WECHATPAY2-SHA256-RSA2048 mchid="...",signature="..."
Body: { appid, mchid, description, out_trade_no, notify_url, amount: { total: 990, currency: "CNY" } }
→ { "code_url": "weixin://wxpay/bizpayurl?pr=..." }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructions and metadata are framed broadly enough that ordinary commerce-related phrases like '我有货想卖' or '帮我做个卖货页面' could trigger the skill in contexts where the user did not clearly consent to creating and publishing a shop page. Overbroad activation increases the chance of unintended collection and transmission of product descriptions or images to the backend, which is risky because this skill creates externally hosted shareable pages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest explicitly instructs the agent to send user-provided product images, descriptions, and later QR code/contact material to https://ruancyai.com/cloud, but it provides no user-facing notice, consent prompt, retention statement, or data-sharing warning. Because the generated output is a hosted, shareable shop page that may include business contact details, the lack of transparency can expose users to unintended disclosure of personal or commercial information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API requires uploading free-form descriptions and optional product images to a remote backend, but the documentation provides no privacy notice, retention policy, or warning that user-supplied content is transmitted off-platform. This creates a meaningful risk of users sharing personal data, phone numbers, faces, addresses, or other sensitive content without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The API explicitly supports uploading a seller's WeChat QR code and then publicly rendering it on the shop page, which expands the skill beyond simple page generation into publishing personally identifying contact data. Because the skill is consumer-facing and produces a shareable public page, users may expose phone, WeChat, and QR-code contact information without clear disclosure or consent safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The QR-code upload endpoint lacks any warning that the uploaded image will be exposed on the public shop page, and QR codes often encode direct contact identities or payment/account links. In this skill's context, publication is especially risky because the resulting page is intended for sharing, increasing the chance of unintended mass disclosure and scraping of personal contact data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

All user-facing instructional content in this file is presented in Chinese, with no indication that the user can choose another language or that the skill is restricted to a Chinese-language audience for a documented reason. This can be a natural-language policy issue when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

SQP-3 applies to natural-language policy issues across all file types, including documentation. This API reference forces a specific language for all instructions and responses in the document, without any opt-in, bilingual alternative, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest says the skill turns input into a shareable mini shop page hosted at ruancyai.com/cloud, so some publishing is expected. However, this file explicitly documents a standalone public HTML page endpoint with product, audio, share links, and contact sections, which is broader than a narrow 'generate page' description and reflects a persistent hosted storefront capability.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:84