上海落户公示查询 (Shanghai Luohu)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:28 AM UTC
• Version: 1.2.1

Overview

This skill fetches public Shanghai residency notice pages and opens the results in a browser, with no evidence of persistence, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable with the skill making requests to sh-italent.com and opening notice pages in your local browser by default. Use the --no-browser option if you only want printed results, and do not rely on the company/person examples for filtering because the inspected code does not implement that filtering.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the skill actually performs AppleScript or GUI automation to control Safari, that is a materially more powerful capability than a normal web query and is not clearly disclosed in the skill description. Local GUI automation can interact with user applications in unexpected ways, expanding the attack surface beyond simple data retrieval.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: If the skill actually performs AppleScript or GUI automation to control Safari, that is a materially more powerful capability than a normal web query and is not clearly disclosed in the skill description. Local GUI automation can interact with user applications in unexpected ways, expanding the attack surface beyond simple data retrieval.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares execution of a Python script that performs network access and local command execution, but it does not define any explicit tool scope such as allowed-tools or permissions. This weakens sandboxing and review guarantees because an agent may grant broader capabilities than users expect for a simple public-notice lookup skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Broad trigger phrases like '上海落户' or '落户公示' increase the chance of accidental invocation for unrelated conversations about household registration. Mis-triggering is security-relevant here because this skill can execute code, perform network access, and open local browser windows without a high-confidence match to user intent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger keyword section lists several ambiguous phrases without boundaries or negative examples, making accidental activation more likely. Because the skill has side effects beyond plain text generation, ambiguity in routing can directly lead to unintended code execution, network requests, or browser launches.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'''
    
    try:
        subprocess.run(['osascript', '-e', applescript], check=True)
        return True
    except:
        # 回退到 webbrowser

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: 技能清单描述聚焦于“查询上海落户公示信息”，而代码进一步声明支持按公司（--company）和按人员（--person）查询指定名单/人员公示。但这两个参数在解析后从未参与任何抓取、过滤或匹配逻辑，实际行为仅是获取并展示最新公示链接与标题，未执行所宣称的定向查询。

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script does more than query and print public notice data: it also drives the local Safari browser via AppleScript and opens multiple pages automatically. Local GUI control is a side effect not required for the stated purpose, and it can surprise users, expand the script's capabilities, and normalize desktop automation in a data-retrieval skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Using AppleScript to control Safari is not justified by the core function of fetching public notices, and it grants the script influence over a local GUI application. Even though the URLs are currently constrained to the target site, this creates unnecessary local-action capability and increases risk if parsing logic or upstream content changes.

Natural-Language Policy Violations

Low

• Confidence: 69% confidence
• Finding: 整个技能文件从名称、描述、触发词到输出示例均固定为中文，未说明是否支持其他语言或允许用户按偏好选择语言。若组织要求技能不得无用户选择地强制特定语言，这种默认单一语言呈现可能构成自然语言策略问题。

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: 文件头注释将该工具描述为“抓取上海国际人才网的落户公示信息并使用浏览器打开”，这暗示打开浏览器是固定行为。但主逻辑中通过 --no-browser 参数可只输出结果而不打开浏览器，文档对实际行为形成了直接不一致的表述。

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file's comments and all user-visible prompts are in Chinese, and the script does not offer any language or locale selection. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.

Static analysis

No suspicious patterns detected.