外贸出口检测与单证合规助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent trade-compliance helper, but its HS lookup script can automatically send product search terms to a placeholder external API without clear opt-in.

Review this skill before installing if you handle confidential product, supplier, customer, or shipment data. Keep HS lookup offline unless you intentionally configure and approve an external service, and do not rely on its compliance outputs as final legal, customs, or export-control determinations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/hs_lookup.py:103

Finding

Automatic Disclosure of Product Search Terms to a Placeholder External Service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/hs_lookup.py:18

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 3. Install from the manifest with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Maintain the pinned version through a controlled update and vulnerability-review process. 5. Recommend installation only inside a dedicated virtual environment. 6. Avoid suggesting administrator or root installation. 7. Document the expected package index and use a trusted, authenticated internal mirror where organizational policy requires it. 8. If online lookup remains optional, keep offline operation as the secure default and avoid prompting users to install an unnecessary network dependency. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The manifest promises broad compliance, document review, and regulatory-checking capabilities that are not actually implemented, while also implying optional networking not disclosed in the description. In a trade-compliance context, this can cause users to rely on incomplete or nonexistent checks for export controls, certifications, and shipping documents, leading to regulatory violations, shipment holds, or unsafe business decisions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill references file reads and network-assisted scripts (references/*, scripts/hs_lookup.py) but does not declare any explicit tool scope or allowed-tools boundary. This creates an authorization ambiguity where the runtime may permit broader access than reviewers or users expect, increasing the risk of unintended file access or external data exfiltration if the skill is later expanded or interpreted permissively.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger terms are extremely broad (验货、检测、合规、单证、外贸、出口、报关) and may cause the skill to activate on ordinary trade conversations outside the user’s intent. In this domain, accidental invocation can expose sensitive commercial documents or lead the model to provide quasi-legal compliance guidance where a general response or explicit consent would have been more appropriate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing natural language exclusively in Chinese, including headings, instructions, and report guidance. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language descriptions and usage text entirely in Chinese, and the interactive/reporting strings throughout the script are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script implements outbound network access to an external HS lookup API even though the skill is described primarily as a local compliance/document assistant. That means user-supplied product keywords may be transmitted off-platform without explicit disclosure, creating a data-governance and privacy boundary violation if users enter sensitive product, supplier, or shipment information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code sends the raw user query directly to an external endpoint via a query string, which expands the skill's behavior beyond the documented local lookup helper. In this trade/compliance context, search terms can contain commercially sensitive details such as product types, battery-related goods, or regulated export items, so undisclosed exfiltration to a third party is risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The hardcoded external URL demonstrates an egress path where user input is embedded into a remote request. Even though the domain is a placeholder example, the implemented pattern is still dangerous because replacing it with a real endpoint would immediately enable undisclosed external transmission of potentially sensitive trade lookup terms.

Content

Scanner excerpt · scripts/hs_lookup.py (reported line 106)May include surrounding context.

python

"""联网查询（调用腾邦HS编码查询API示例）"""
    try:
        # 注意：实际使用时请替换为可用的HS编码查询API
        url = f"https://api.example.com/hs/search?q={keyword}"
        resp = requests.get(url, timeout=5)
        if resp.status_code == 200:
            return resp.json()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow specifies generating an “英文合规说明函” as the output format, but does not indicate that the user can choose the language. This is a locale/language policy concern because it imposes a specific language by default rather than offering a user-facing option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructions and checklist content exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire markdown file is written in Chinese and does not indicate that the user may choose another language or that the content is intentionally restricted to a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file is natural-language content and appears to require Chinese comprehension throughout, from the title to all compliance tables and disclaimers. Under the language/locale policy, forcing a specific language without user opt-in or a clearly documented regional justification is a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.