省柴柴·全平台商品比价助手

• Outcome: Review
• Latest audit: Aug 7, 2026 · 3:31 AM UTC
• Version: 1.3.0

Overview

This shopping assistant largely matches its stated purpose, but it hides important cloud, tracking, affiliate-link, and local persistence behavior from users.

Review before installing. This skill sends shopping searches to remote services, creates or reuses a proxy token, may generate affiliate or tracked purchase links, and stores shopping preferences/reminders locally. Install only if you accept that tracking and persistence model, and remove any bundled token or preference files before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill metadata declares no permissions, yet the analyzed implementation reportedly uses environment-derived capabilities and external service interaction. This creates a transparency gap: users and hosts cannot accurately assess what sensitive runtime access the skill needs, which can hide data flow to external services or use of secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This is a strong description-behavior mismatch: the skill presents itself as a simple price comparison and reminder assistant, but the implementation reportedly also generates affiliate/tracking links, auto-registers with an external proxy service, caches tokens, forwards requests, and persists user preference/log data locally. These hidden behaviors materially change the trust and privacy model, increasing the risk of undisclosed tracking, monetization, and data exfiltration.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The README claims the skill does not collect or store personal information or user preferences, but earlier functionality explicitly says it 'remembers your preferences' and 'gets to know you better over time.' This contradiction can mislead users about what data is retained or processed, undermining informed consent and potentially causing privacy or compliance issues if preference data is in fact stored or profiled.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code converts ordinary product URLs into affiliate/promotion links and injects tracking/channel identifiers, which expands the skill's behavior beyond the stated price-comparison purpose. This creates an undisclosed monetization and tracking path where user shopping activity can be attributed to the skill operator or third parties, making the behavior security- and trust-relevant even if not overtly malicious.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script silently registers with a remote proxy backend, obtains a token, caches it locally, and forwards user query parameters to that backend. Because this backend interaction is not described by the manifest, it introduces hidden external dependency, credential lifecycle, and data-flow behavior that users and platform reviewers would not expect from a simple price-comparison skill.

Context-Inappropriate Capability

Low

• Confidence: 86% confidence
• Finding: The code stores a proxy registration token in a local token.json file without clear necessity for the advertised functionality. Persistent local credential storage increases the chance of token leakage through filesystem access, packaging mistakes, or reuse across contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README states that all queries are sent to cloud interfaces, but it does not clearly warn users that product searches, interests, and possibly shopping-related behavior leave the local environment. For a shopping assistant that may process user intent and preferences, this lack of disclosure increases privacy risk and may expose sensitive consumer behavior to third-party services without meaningful user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill says it will remember shopping preferences and send WeChat reminders, but provides no user-facing privacy notice about what data is collected, where it is stored, how long it is retained, or whether it is shared with third parties. In the context of a commerce assistant that may build user profiles and push recommendations, this omission creates meaningful privacy and consent risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to persistently read and write user preference and learning files on every interaction, but it does not require any user notice, consent, retention limit, or deletion control. In a shopping assistant context, these files can accumulate behavioral and preference data over time, creating a privacy risk through silent profiling and unnecessary long-term storage.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to automatically log inferred dissatisfaction ('negative') or missed needs ('miss') based on user behavior, without explicit disclosure or consent. This is dangerous because it expands profiling beyond what the user intentionally provided, potentially storing sensitive behavioral inferences that can affect future recommendations without the user's knowledge.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill writes a registration token to local disk without any user-facing disclosure or consent. Undisclosed credential persistence is dangerous because it creates a hidden artifact that may survive across runs, be copied with the workspace, or be exposed to other local processes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script transmits user search terms, filters, device info, and authentication token to a remote proxy service without user-facing disclosure. Even over HTTPS, this is a privacy and trust issue because user shopping intent and backend credentials are silently shared with an external service not obvious from the skill description.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The code performs automatic remote registration to obtain a token with no user-facing disclosure. This hidden network action is risky because it establishes an external account/session relationship and backend dependency that users and reviewers would not reasonably infer from the stated purpose alone.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The script persistently stores user shopping preferences and a learning log to local JSON files without any explicit notice, consent prompt, retention control, or deletion mechanism. In a shopping-assistant context, these preferences can reveal behavioral patterns and sensitive consumer habits, so silent persistence creates a privacy risk even though it is not direct code execution or privilege escalation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.