Security audit

十元云铺万元利

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates paid, shareable mini shop pages, but users should understand their images and contact details are sent to a hosted public service.

Install only if you are comfortable sending product photos, descriptions, prices, phone or WeChat details, and optional QR codes to ruancyai.com for a public shareable page. Treat contact and payment QR data as public, and confirm the fee and refund terms before creating a shop page.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The changelog documents a full payment, callback, status, and refund pipeline that materially contradicts the skill's declared purpose as display-only lead generation with no platform participation in transactions. This mismatch is dangerous because it can hide undeclared money-handling behavior from reviewers, users, and calling agents, increasing the risk of unauthorized charges, payment abuse, and trust-boundary violations.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Implementing WeChat/X402 payment processing is not reasonably necessary for generating a mini shop showcase page, so it represents scope expansion into sensitive financial operations. In this skill context, that makes the behavior more dangerous because users and platform reviewers would expect a marketing page generator, not a payments-integrated service capable of collecting or validating payment artifacts.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The README asserts that the platform only provides display and lead generation and does not participate in transactions, yet it also references a backend payment module. This inconsistency can mislead users, reviewers, and integrators about the true data flows and financial functionality, which is a security and trust risk because payment handling introduces materially different compliance, fraud, and privacy concerns.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: Nearby documentation says the platform does not participate in transactions, while the backend dependency section points to a payment module. In a selling/lead-generation skill, that contradiction increases the chance that operators or users will underestimate financial-risk surfaces such as payment collection, QR-code abuse, or hidden transaction enablement.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README encourages uploading product photos, free-form text, and optionally WeChat payment/business-card QR codes, but provides no warning about privacy, retention, public exposure, or third-party sharing. Because the output is a shareable public mini-site, users may inadvertently expose personal contact details, financial QR codes, metadata, or sensitive images without informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs users to provide product images and contact details, and explicitly sends them to a remote backend, but it does not clearly warn users that these potentially sensitive data are transmitted off-platform and hosted at ruancyai.com. This can lead to unintended disclosure of personal phone/WeChat identifiers and commercially sensitive inventory images, especially because the resulting page is designed for sharing.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill is designed to activate on very broad, everyday phrases like greetings and generic selling requests, which can cause unintended invocation outside the user's clear intent to use this specific commerce workflow. In context, unintended activation may lead users to share product details or images and trigger remote backend interactions without a sufficiently explicit consent boundary.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to send uploaded product images, descriptions, and later QR/contact information to a remote backend, but the user-facing description does not clearly disclose that this data leaves the chat environment. This creates a privacy and consent risk because users may provide business-sensitive inventory, pricing, or contact data without understanding it will be transmitted to ruancyai.com.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The API explicitly extracts phone numbers and WeChat IDs from free-form user descriptions and publishes them on a public shareable page and in generated share materials, but the spec contains no user-facing consent, notice, minimization, or privacy-control requirements. This creates a real privacy and safety risk because users may include personal contact data unintentionally, and the system is designed to redistribute that data via public URLs.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:84