Security audit

租赁-卖家找买家

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated purpose, but it needs review because it can automatically send seller query details to a backend, queue them locally, and use admin-level credentials.

Install only if you are comfortable with seller search details and user IDs being submitted to your configured backend or stored in a local outbox when submission fails. Use a narrowly scoped service token instead of admin credentials, restrict the backend URL, protect or clean the cache/outbox directory, and expose the FastAPI service only behind appropriate access controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill invokes local scripts and a web service, and its documented workflow requires environment access, file reads/writes, and network communication, yet it declares no permissions. This creates a privilege-transparency gap: operators and policy layers cannot accurately evaluate or constrain what the skill can access, increasing the risk of unintended data exposure, unauthorized outbound requests, or unsafe filesystem interactions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation describes sending seller demand data to a backend and persisting failed submissions to a local outbox, which introduces data collection and retention behavior beyond the core buyer-matching function. Even though the metadata mentions query recording, this backend sync is not transparently scoped or minimized, creating unnecessary privacy and data-governance risk if user identifiers and vessel-sale intent are stored without clear consent and controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Referencing optional ADMIN_API_KEY or ADMIN_TOKEN for routine demand synchronization is dangerous because administrative credentials imply elevated privileges that are not justified for a simple seller-demand submission workflow. If those secrets are used by the skill or exposed through logs, misconfiguration, or prompt/skill abuse, an attacker could gain broader backend access than necessary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file does more than local buyer matching: it posts seller demand payloads to a configurable remote endpoint and stores unsent payloads on disk. That creates an undisclosed data exfiltration and retention path for potentially sensitive business information, especially because the destination is controlled by environment configuration rather than being fixed and constrained in code.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Using administrative credentials for this skill expands its privilege beyond simple buyer matching and lets the code authenticate to a backend with elevated access. If the endpoint or runtime is misconfigured, those credentials could be used to submit or influence backend data in ways unrelated to the user request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file describes transmitting user_id and vessel sales criteria to a backend and, on failure, writing the same data to demand_outbox.jsonl, but provides no user-facing disclosure or consent flow. This is risky because it silently exports potentially sensitive commercial intent data and may leave residual local records that are easier to access, copy, or forget to delete.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code transmits payload data to a remote backend without any in-flow notice, consent, or disclosure mechanism. In this skill context, seller demand details may contain commercially sensitive information, so silent transmission increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: When sync fails or is unconfigured, payloads are appended to a local JSONL outbox without disclosure or visible retention controls. That creates silent at-rest storage of potentially sensitive seller information that may persist longer than intended and be accessible to other local processes or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: When sync_demand_record is enabled and user_id is present, the code automatically sends user and query attributes to sync_demand(...) without any user-visible consent, notice, or minimization in this file. In a skill that processes seller intent and potentially identifying business preferences, silent synchronization can leak personal or commercially sensitive data to another service unexpectedly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.