个人应用商店发布助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:31 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent app-publishing helper, but it can automatically create an external account, upload an app package, expose an upload token, and initiate a payment flow without a clear prior consent checkpoint.

Install only if you are comfortable with this skill using appstore.qinghuan.fun, creating account state there, uploading your build artifacts, and handling payment activation. Before use, require the agent to ask before registration, payment, upload, public publication, or deletion; keep APPSTORE_TOKEN out of logs; set private visibility deliberately; and add integrity checks to any auto-update client code copied from the skill.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:314

Finding

Remote Update Package Downloaded and Presented for Installation Without Application-Level Integrity Verification

Content

View full analysis

val json = JSONObject(reader.readText()) val latest = json.optJSONObject("latest") UpdateInfo( hasUpdate = json.optBoolean("hasUpdate", false), versionName = latest?.optString("version_name"), versionCode = latest?.optLong("version_code", 0L) ?: 0L, downloadUrl = latest?.optString("download_url"), fileSize = latest?.optLong("file_size", 0L) ?: 0L, updateNote = latest?.optString("update_note"), ) } } finally { conn.disconnect() } } ``` ```kotlin class AppStoreInstaller(private val context: Context) { fun download(url: String, fileName: String = "update.apk"): File { val out = File(context.cacheDir, fileName) val conn = (URL(url).openConnection() as HttpURLConnection).apply { connectTimeout = 15_000 readTimeout = 60_000 instanceFollowRedirects = true } try { conn.inputStream.use { input -> out.outputStream().use { input.copyTo(it) } } } finally { conn.disconnect() } return out } fun install(apk: File) { val uri: Uri = i ...[truncated 2821 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:78

Finding

Bearer Upload Credential Exposed in Console and Agent Output

Content

View full analysis

/dev/null) if [ -n "$TOKEN" ]; then echo "✅ Registration succeeded, credential: $TOKEN" export APPSTORE_TOKEN="$TOKEN" AUTH="Authorization: Bearer $TOKEN" else echo "Registration failed: $RESP" echo "Visit $BASE/register to register manually, or contact an administrator." exit 1 fi ``` ### Technical Analysis The registration response contains a bearer upload token, and the workflow explicitly prints that token to standard output. Standard output may be retained in terminal history, CI logs, Agent transcripts, monitoring systems, support bundles, or shared session records. A bearer token grants access based on possession. Printing it unnecessarily expands the credential's exposure beyond the process that needs it. The failure branch also prints the complete server response, which could disclose sensitive response fields if the API returns a partially successful or unexpectedly verbose payload. ### Attack Path 1. The Skill automatically registers an account and receives an `upload_token`. 2. The token is printed to standard output. 3. Output is retained in an Agent transcript, CI log, terminal capture, or centralized logging platform. 4. An attacker or unauthorized collaborator obtains access to that retained output. 5. The attacker copies the token and supplies it as an `Authorization: Bearer` credential. 6. The attacker invokes application-management endpoints under the affected account. ### Impact Assessment An exposed token may permit unauthorized publication of application versions and access to owner-author ...[truncated 278 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:65

Finding

Application Package Transmitted to a Third Party Before Explicit Registration and Payment Consent

Content

View full analysis

/dev/null) if [ -n "$TOKEN" ]; then export APPSTORE_TOKEN="$TOKEN" AUTH="Authorization: Bearer $TOKEN" else exit 1 fi ``` ```bash UPLOAD_RESP=$(curl -sS -X POST "$BASE/api/apps/$app_id/upload" \ -H "$AUTH" \ -F "version_name=$version_name" -F "version_code=$version_code" \ -F "file=@$package_path" 2>&1) ``` ### Technical Analysis Uploading a package is necessary for the declared publishing function, but performing the upload before obtaining informed consent is not necessary. The package is sent to an external service merely to trigger and inspect the account-activation response. The user is informed of the payment requirement only after the registration and upload attempt. This design exceeds minimum necessary behavior because account status could be checked using a metadata-only verification endpoint before transmitting the build artifact. The documented workflow also defaults application visibility to public unless overridden, which increases the potential exposure of inadvertently uploaded proprietary artifacts. ### Attack Path 1. A user invokes the publishing workflow without an existing `APPSTORE_TOKEN`. 2. The Agent follows the instruction not to stop for confirmation. 3. An external account is created automatically. ...[truncated 1104 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says that if APPSTORE_TOKEN is missing, the agent should automatically register and continue without stopping to ask the user. This bypasses informed consent for creating third-party accounts and sending metadata externally, which is especially dangerous in an agentic workflow that may act autonomously.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The auto-registration block sends account data to an external service and prints the returned upload token to output. This combines unconsented external transmission with credential exposure, making accidental leakage through logs, transcripts, terminal history, or downstream tools more likely.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

NAME="Agent 用户"

# 调用注册接口
RESP=$(curl -sS -X POST "$BASE/api/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"account\":\"$ACCOUNT\",\"name\":\"$NAME\"}")

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-activation section directs the agent to create a payment order and continue polling for completion, but does not require an up-front user warning or confirmation. Payment-related actions are highly sensitive and should never be initiated implicitly during a publishing workflow.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

# 轮询检查支付状态（每 3 秒一次，最多 60 秒）
    for i in {1..20}; do
      sleep 3
      ORDER_STATUS=$(curl -sS "$BASE/api/orders/activate/query?order_id=$ORDER_ID" -H "$AUTH" | python3 -c "import sys,json; print(json.load(sys.stdin).get('data',{}).get('status',0))" 2>/dev/null)
      if [ "$ORDER_STATUS" = "1" ]; then
        echo ""
        echo "✅ **支付成功！账户已激活！**"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

done
    
    # 再次检查激活状态
    USER_STATUS=$(curl -sS "$BASE/api/auth/verify" -H "$AUTH" | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',0))" 2>/dev/null)
    if [ "$USER_STATUS" != "1" ]; then
      echo ""
      echo "⚠️ 支付状态检测超时，请手动刷新页面或联系管理员。"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The skill includes a direct deletion path for arbitrary version IDs, which can be dangerous if an agent obtains or guesses identifiers and invokes the endpoint without strong confirmation. In a tool-using agent context, destructive parameterized operations are high risk because they are easy to misapply and may permanently remove release history.

Content

Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.

md

A: 
1. 获取 version_id：`GET /api/apps/$app_id`
2. 删除版本：`DELETE /api/versions/$version_id`
3. 确认：再次 `GET /api/apps/$app_id` 查看版本列表

### Q: 账号激活后能否退款？

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad natural-language requests such as publishing or pushing to the store, which can overlap with ordinary conversation and automation tasks. Over-broad invocation criteria can cause the agent to perform networked publishing actions unexpectedly, especially in environments with tool execution enabled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to automatically register accounts and initiate an activation/payment workflow when credentials are absent, going beyond ordinary package publishing. This can cause unauthorized account creation, transmission of project-derived identifiers to a third-party service, and pressure users into a payment flow they did not explicitly approve.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This code transmits account registration data to an external service. In the context of an agent skill, the danger is amplified because the transmission is prescribed as automatic when no token is present, reducing user awareness and control over outbound data flows.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

NAME="Agent 用户"

# 调用注册接口
RESP=$(curl -sS -X POST "$BASE/api/auth/register" \
  -H "Content-Type: application/json" \
  -d "{\"account\":\"$ACCOUNT\",\"name\":\"$NAME\"}")

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation warns not to hardcode tokens in clients, yet the Android checker API is designed to accept an upload token directly and adds it as a Bearer header. In practice, developers may embed the upload credential in mobile binaries, allowing reverse engineering and compromise of private app access or owner-scoped operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata and primary description position this as a publishing/update-assistant, but the document also exposes destructive app-management operations including deleting apps and versions. This scope expansion increases the chance an agent invokes dangerous administrative actions without the user realizing the skill has deletion capability.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 475)May include surrounding context.

A: 上传时加 -F "is_public=0"，或上传后调用：

bash

curl -X PUT "$BASE/api/apps/$app_id" -H "$AUTH" \
  -H "Content-Type: application/json" \
  -d '{"is_public": false}'

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

文件标题、描述和全部操作说明均固定为中文，没有说明这是仅面向中文用户的区域性技能，也没有提供语言选择或用户偏好适配。根据规则，强制单一语言而无用户选择可构成语言/区域政策问题。

Content

No source excerpt is available for this finding.