Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
企业风险排查
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Qixin enterprise risk lookup client, with expected external API use and no hidden persistence, exfiltration, or destructive behavior found.
Install only if you intend to send company names or enterprise IDs to Qixin using your QXBENT_API_TOKEN. For important diligence decisions, prefer an exact enterprise ID and confirm that the returned ename is the company you meant to query. Review resolved npm dependency versions during install because the package does not include a lockfile.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
All user-facing description and usage examples are written in Chinese, and the file does not indicate that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking or China-specific user context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example "这家公司是不是空壳公司？帮我查一下风险" uses a generic phrase like "帮我查一下风险" without clearly constraining the skill to enterprise risk-assessment contexts. In markdown skill descriptions, broad natural-language examples like this can contribute to unintended invocation because they resemble ordinary user requests rather than a narrowly scoped trigger.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill states that when an enterprise name cannot be precisely matched, it will automatically use the first search result. In a risk-assessment workflow, this can cause analysis and downstream decisions to be made on the wrong company, leading to severe integrity failures, misdirected due diligence, and possible disclosure of sensitive business intelligence about an unintended target.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The method sends the user-provided enterprise name to a remote service via POST, but this file contains no confirmation prompt, logging, or user-facing warning that the data will be transmitted externally. For code files, outbound network transmission of user or system data should have some visible disclosure unless clearly covered elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This method posts a company identifier to an external endpoint, yet the file provides no confirmation, visible log, or warning that the identifier leaves the local environment. Under the code-file criteria, network calls carrying user data should include some form of disclosure unless already clearly documented.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This is a manifest file, so vague-trigger review applies. The description only states the skill's broad capabilities and domain, but provides no explicit trigger phrases, activation scope, or exclusion conditions, which can make invocation boundaries unclear in agent selection contexts.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using a caret range for axios allows installs of newer matching releases without a fully reproducible dependency set. Because axios has a history of security advisories and this skill likely performs network requests for enterprise risk checks, an affected resolved version could expose the skill to issues such as SSRF, proxy bypass, or request/response manipulation depending on usage.
- Content
json "author": "", "license": "MIT", "dependencies": { "axios": "^1.6.0" }, "devDependencies": { "@types/node": "^20.0.0",
Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The manifest references axios with a non-exact version, so it is impossible to verify from package.json alone whether the installed release includes fixes for known axios advisories. In a skill that likely calls external services and processes potentially sensitive enterprise data, uncertainty around a historically vulnerable HTTP client raises meaningful supply-chain and network-security risk.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "axios": "^1.6.0" }, "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json }, "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" } }
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The class documentation and user-facing error text are written only in Chinese, and the file does not indicate that language is configurable or user-selected. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The thrown error message is a natural-language string presented only in Chinese, with no evidence of locale negotiation or user preference handling. Policy guidance says to flag language forcing unless the locale constraint is explicitly justified or optional.
- Content