Security audit

Add to Cart from Bitable

Security checks for vulnerabilities and agentic risk

Overview

This skill can change shopping carts through an authenticated browser and send procurement results to a fixed Telegram account, with important safety controls missing or ineffective.

Review before installing. Only use this with a dedicated shopping browser profile, trusted Bitable records, strict Taobao/Tmall URL validation, an explicit confirmation step before live cart changes, and removal or user-controlled configuration of the Telegram notification.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:119
Finding: Procurement Results Are Exfiltrated to a Hard-Coded Telegram Account
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Unvalidated Record URLs Are Opened in a Persistent Authenticated Browser Profile
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/index.js:8
Finding: Declared Dry-Run Mode Does Not Prevent Shopping-Cart Modification
Content: View full analysis
{ // 查找加购按钮 // 常见类名：J_LinkAdd, add-cart-btn, btn-add-cart // 常见文本：加入购物车, 加入购物袋 const buttons = document.querySelectorAll('a, button, div[role=button]'); for (let btn of buttons) { const text = btn.innerText || btn.textContent; if (text && (text.includes('加入购物车') || text.includes('加入购物袋'))) { btn.click(); return true; } } return false; }` } }); ``` ### Technical Analysis The public `process` function destructures and advertises a `dryRun` option, but neither `process` nor `processSingleRecord` uses it to suppress browser mutations. Consequently, setting `dryRun: true` has no effect on the workflow. This violates the expected semantics of a dry-run safety control. A caller may reasonably use this option to preview records, validate configuration, or test browser connectivity while assuming that no cart changes will occur. The script nevertheless opens the product page, selects a specification, changes the quantity, and clicks the ...[truncated 1019 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This skill performs purchase-adjacent browser actions on third-party commerce sites and also documents sending a Telegram notification, yet it provides no clear warning or confirmation step. That makes unintended commercial actions and data disclosure more likely, especially because the inputs come from a remote table and the browser actions are automated via evaluate-based DOM interaction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation introduces Telegram notifications even though the stated purpose is reading Bitable records and adding items to shopping carts. That scope expansion creates an unnecessary outbound data channel that could leak purchase details or be repurposed for covert exfiltration without the user expecting it.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Hard-coding outbound messages to a fixed Telegram account is a strong exfiltration indicator because it sends operational data to an external recipient unrelated to the user. In the context of a shopping automation skill, this capability is unjustified and could disclose procurement activity, item details, or future extendable sensitive data without authorization.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata says it pulls product data from Feishu Bitable, but the implementation ignores the provided Bitable URL and uses a hard-coded product record instead. In a purchasing automation context, this can cause unintended or misleading actions by adding the wrong item to cart, breaking user trust and enabling deceptive behavior if the hard-coded target is changed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script performs add-to-cart browser actions immediately once product page elements are found, without an explicit user confirmation step or a clear preview of items about to be added. In an e-commerce automation skill, this increases the risk of unauthorized purchasing workflow actions, accidental bulk cart manipulation, or abuse if the upstream records are incorrect or tampered with.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The automation only searches for Chinese UI labels such as "加入购物车" and "加入购物袋", which forces a specific locale assumption in the skill behavior. There is no opt-in, fallback, or documented justification for restricting the skill to a Chinese-language interface.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.