Security audit

Wenqisheng Ear Care

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real customer-service purpose, but it also installs self-updating code, changes agent behavior on broad keywords, and contains unrelated development-bot functionality that users should review before installing.

Review this before installing. Prefer manual installation from a pinned, inspected release; do not add the CLAUDE.md auto-install rule; remove the cron or scheduled-task updater unless you explicitly want unattended repository pulls; and do not expose the bot server publicly until webhook signature verification and the unrelated development-bot routes are fixed. Also treat the ear-symptom guidance as wellness/store information, not medical advice.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (41)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The README presents a simple customer-service skill, but instructs users/agents to install it by piping a remote script into a shell and enabling daily auto-updates. That introduces ongoing code-execution capability on customer machines that is disproportionate to the stated purpose and creates a supply-chain risk if the repository or delivery path is compromised.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documented installation method uses curl/irm piped directly to bash/iex, which executes unaudited remote code immediately. For a store-information skill, this is unjustified and allows full compromise of the host if the script, repository, account, or network path is malicious or tampered with.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The README tells operators to modify agent behavior so that merely mentioning broad keywords triggers automatic download, installation, and update actions. This converts ordinary conversation into an execution trigger, enabling unintended code fetches and expanding the attack surface through prompt-driven software installation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The README explicitly instructs users to fetch and immediately execute a remote shell or PowerShell installer using a pipeline. That creates a direct code-execution path from an external source without review, pinning, checksum validation, or consent boundaries, which is unnecessary for a customer-service skill whose stated purpose is answering store questions.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The README describes automatic installation and updating based solely on conversation keywords, causing software changes to occur from ordinary user prompts rather than deliberate admin action. For a customer-service skill, auto-installing and running update logic on keyword mention exceeds functional necessity and creates a supply-chain and unauthorized-execution risk.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill says safety is a priority and that it must not diagnose, but for red-flag ear symptoms like pus, severe pain, bleeding, or sudden hearing loss it directs users to the shop first and only suggests hospital care if the situation seems 'very serious.' This can delay urgent medical evaluation for conditions where prompt care matters, creating a real risk of harm.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The emotion-handling table reinforces the same unsafe triage pattern by defaulting urgent symptoms to an in-store visit rather than medical care. Repetition of this instruction across the skill increases the chance the agent will confidently give harmful advice in a health-adjacent context.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements a general-purpose multi-provider LLM client plus role-based software-development agents, which is materially broader than the declared ear-care store customer-service skill. This scope mismatch increases the chance that the deployed skill can be repurposed for unrelated code-generation or orchestration tasks, weakening least-privilege boundaries and creating unexpected behavior paths not justified by the manifest.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The embedded multi-role prompts enable coordination of frontend and backend coding tasks inside a skill that is supposed to answer questions about an ear-care store. In this context, hidden development-agent capabilities are dangerous because they create an unauthorized secondary function that could be abused for code generation, system design, or operational coordination far outside the advertised business purpose.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The root endpoint advertises this service as a multi-role collaborative development bot with reviewer/frontend/backend orchestration, which directly contradicts the declared ear-care customer-service purpose. This kind of capability mismatch is dangerous because it can conceal unauthorized agent behaviors and expose hidden operational interfaces that may be used outside the approved business context.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The file header presents the server as an ear-care store bot, but the runtime descriptions and exposed interfaces indicate a different system role. This discrepancy is a strong indicator of deceptive packaging or scope smuggling, which can bypass review and cause operators to deploy functionality they did not intend to approve.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The dedicated reviewer, frontend, and backend bot endpoints are unrelated to a normal store customer-service assistant and expand the exposed attack surface. Hidden or unnecessary role-specific interfaces can be abused for unauthorized prompt routing, data access, or execution of workflows that were never disclosed in the skill description.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The signature verification function claims to validate DingTalk request authenticity but unconditionally returns true, so any external party can forge webhook requests to the bot endpoint. This allows unauthorized message injection, conversation poisoning, abuse of downstream AI calls, and potentially denial of service or impersonation of legitimate DingTalk users.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file implements a Feishu multi-bot reviewer/frontend/backend orchestration system, which materially differs from the declared ear-care store customer-service skill. This kind of capability mismatch is dangerous because it can conceal undeclared behaviors, expand the operational scope of the skill, and undermine trust and review assumptions about what the skill is allowed to do.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code routes messages among reviewer, frontend, and backend bot roles and shares history across them, which is unrelated to a store-information customer-service bot. Undeclared orchestration increases the chance of hidden data handling, privilege expansion, and misuse of user conversations beyond the expected customer-service context.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The function can proactively send outbound Feishu messages using platform APIs, a capability not described in the manifest. Undeclared outbound messaging can be abused for spam, unsolicited contact, or silent exfiltration of generated or user-supplied content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The installer creates a persistent scheduled task that automatically updates the skill every day, but this behavior is not disclosed by the skill's stated customer-service purpose. Undisclosed persistence expands the trust boundary: future repository changes can be pulled and executed repeatedly without a fresh user review, which is unnecessary and risky for a storefront FAQ skill.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script registers a Windows scheduled task that launches bash to run an external shell script on a daily basis. This introduces cross-shell code execution and a persistence mechanism unrelated to the advertised ear-care客服 functionality, creating a path for unattended execution of repository-controlled code if the local script or upstream content changes.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The installer establishes persistent auto-update behavior by adding a cron job, which exceeds the stated purpose of installing a customer-service skill. This creates an ongoing execution path that can later pull and run changed code without fresh user review, increasing supply-chain and persistence risk.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script modifies the user's cron scheduler to run a repository-provided update script daily, a host-level persistence capability unrelated to an ear-care store support skill. Because cron executes automatically, any future compromise or malicious change in the repository could gain recurring code execution on the host.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file contains internal safety guidance stating the AI must not directly judge ear conditions, yet earlier FAQ entries give condition-specific assurances such as saying people with otitis media can receive service and suggesting service options for itching, tinnitus, and blockage. In a health-adjacent customer service skill, this inconsistency can cause the agent to provide quasi-medical advice or inappropriate reassurance, delaying proper care for serious ear conditions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script performs remote code synchronization and modifies the local skill checkout by fetching and pulling from origin, which exceeds the stated ear-care customer-service purpose. This creates a supply-chain risk: anyone who can influence the remote repository or branch can change local behavior on customer systems without review.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The comments instruct operators to schedule unattended daily execution via cron, enabling persistent self-update behavior unrelated to the declared customer-service functionality. In the skill context, this is more suspicious because a storefront Q&A assistant should not need autonomous code-maintenance capabilities on the host.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger set includes generic terms like '采耳' and '耳部护理', which are common enough to appear in ordinary conversation. When paired with auto-install logic, these broad prompts can cause unintended activation and downstream code execution for users who never explicitly requested software installation.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README encourages automatic script execution and persistent auto-update without clearly warning users that system changes and future code pulls will occur. Lack of prominent disclosure and consent increases the chance of silent host modification and makes social engineering easier.

Static analysis

No suspicious patterns detected.