BigFocus · 追踪管家（商品价格·明星动态·行业追踪·自定义指标）| Personal Price, Celebrity & Industry Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 1.0.3

Overview

BigFocus mostly matches its stated tracker purpose, but its persistent scheduled scans can make unsafe user-controlled web requests and its stored tracker data can be corrupted by unescaped input.

Install only if you are comfortable with a persistent hourly tracker that can read and write its workspace memory, perform web searches, fetch product/API pages, and send update messages. Review or patch URL validation before enabling automatic product scans, keep cron setup explicit, and avoid adding tracker names, targets, or values from untrusted sources until the Markdown storage is hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bigfocus.py:421

Finding

Server-Side Request Forgery Through Insufficient Product URL Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bigfocus.py:78

Finding

Persistent Tracker Corruption and Markdown Injection Through Unescaped Fields

Content

View full analysis

= 9: # 前有空列 + 8列数据 # parts[0] 是第一个 | 前面的空串 # parts[1]~parts[8] 是8列数据 item = { 'id': int(parts[1]) if parts[1].isdigit() else parts[1], 'name': parts[2], 'type_': parts[3], 'target': parts[4], 'interval_h': int(parts[5].rstrip('hH')) if parts[5].replace('h','').replace('H','').strip().isdigit() else 24, 'next_check': parts[6], 'last_update': parts[7], 'last_value': parts[8], 'status': parts[9] if len(parts) > 9 else 'active', } items.append(item) ``` ```python def _format_table_row(item): """Format a single item dict as a table row.""" name = item['name'] type_ = item.get('type_', '') target = item.get('target', '') interval_h = item.get('interval_h', 24) next_check = item.get('next_check', '-') last_update = item.get('last_update', '-') last_value = item.get('last_value', '-') status = item.get('status', 'active') idx = item.get('id', 0) # 只写数字，列标题已标注 (h) interval_str = str(int(interval_h)) return f'| {idx} | {name} | {type_} | {target} | {interval_str} | {next_check} | {last_update} | {last_value} | {status} |' ``` ### Technical Analysis The tracker uses a Markdown table as its authoritative structured-data store. Valu ...[truncated 2835 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase set includes broad activators such as 'bigfocus', which can appear in normal conversation and unintentionally invoke the skill. Because the skill can perform file writes, web searches, and scheduled operations, accidental activation can lead to unintended data changes or background monitoring setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Several triggers like '添加追踪', '删除追踪', '恢复追踪', and '价格追踪' are generic conversational phrases that could match ordinary discussion rather than a deliberate tool invocation. In this skill's context, that raises the risk of unintended reads/writes and erroneous state changes, especially when combined with automation and cron-backed persistence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The add flow is internally contradictory: one section says no write occurs until the user confirms, but the later steps describe adding first and then updating or removing on follow-up. In an agent setting, contradictory instructions can cause premature writes before consent, creating unauthorized persistent state changes or accidental tracking entries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This shell script installs a recurring cron task that performs scans and may push updates via messaging channels, affecting external systems on an automated basis. The file contains operational steps but no explicit warning, confirmation, or user-facing disclosure that it will create a scheduled job and send notifications to a target channel/chat.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest-style JSON defines a trigger-like entry named “定时扫描（每整点）”, but it does not specify concrete activation boundaries beyond a human-readable label. There are no explicit exclusion conditions or negative examples, which could make the invocation scope unclear in systems that map descriptions or names to activation behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instruction string is entirely in Chinese and directs the agent's behavior in that locale without offering user opt-in or any language-selection mechanism. Under the stated policy, forcing a specific language without user choice is a locale-policy concern unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language interface, usage strings, status messages, and help text are consistently presented only in Chinese, with no option for user language selection. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Tainted flow: 'TRACKER_FILE' from os.environ.get (line 24, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/bigfocus.py (reported line 129)May include surrounding context.

python

lines.append(_format_table_row(item))
    lines.append('')  # trailing newline

    with open(TRACKER_FILE, 'w', encoding='utf-8') as f:
        f.write('\n'.join(lines))

    return items

Tainted flow: 'RAW_DATA_FILE' from os.environ.get (line 25, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/bigfocus.py (reported line 145)May include surrounding context.

python

def _save_raw_data(data):
    with open(RAW_DATA_FILE, 'w', encoding='utf-8') as f:
        json.dump(data, f, ensure_ascii=False, indent=2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill makes outbound HTTP requests to user-supplied or skill-derived targets during automatic scanning without any explicit user-facing disclosure or consent gate. This can leak user tracking interests and cause unexpected network access to third-party services, especially when product URLs or monitored indicators encode sensitive interests or identifiers.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The script transmits data to an external service (CoinGecko API) during automatic metric fetching. While the request is limited, external transmission still expands the trust boundary and can expose usage patterns, monitored interests, timing metadata, and network identifiers without strong user awareness.

Content

Scanner excerpt · scripts/bigfocus.py (reported line 454)May include surrounding context.

python

try:
                # CoinGecko 免费 API
                req = Request(
                    'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd',
                    headers={'Accept': 'application/json'}
                )
                resp = urlopen(req, timeout=10)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The cron configuration hard-codes the timezone to "Asia/Shanghai", which imposes a locale-specific behavior without indicating user choice or opt-in. This can violate language/locale policy expectations when the skill is used by users in other regions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sets --tz "Asia/Shanghai", which imposes a specific locale setting in natural-language-configured behavior. There is no indication that the user opted into this locale or that the skill is intentionally restricted to that region.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.