选品分析

• Outcome: Review
• Latest audit: Aug 16, 2026 · 2:43 AM UTC
• Version: 1.0.2

Overview

The skill appears to perform the advertised product-research workflow using browser-collected or user-provided data and a Yufluent cloud API, with no hidden persistence or destructive behavior found.

Install only if you are comfortable sending product candidate data, search terms, and browser-extracted market data to Yufluent's cloud service. Keep BROWSER_SERVICE_URL pointed at a trusted local or managed Browser Service, and consider pinning or constraining the requests dependency before production use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include very broad business-language terms such as “选品分析”, “这个品类能不能做”, and “product research”, which can match ordinary conversation and cause the skill to activate when the user did not explicitly intend to invoke it. Because this skill then directs the agent into browser collection and external API/Harness execution, accidental invocation can lead to unnecessary data access, unexpected network actions, or workflow hijacking by a loosely related prompt.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation guidance says phrases like “自动选品 / browser选品 / 帮我选品 + 品类名 / 选品分析 + 品类名” must trigger an automated workflow, but these are still broad natural-language requests that overlap with normal assistance requests. In an agent ecosystem, this increases the risk of unintended workflow execution, including navigation, extraction, and submission of collected data to a remote service without sufficiently explicit user consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script collects either user-supplied product candidate data or browser-discovered data and sends it to a remote cloud API via run_skill() without any explicit notice, confirmation, or redaction step. In a thin client context this can expose proprietary market research, internal business inputs, or unintentionally collected third-party data to an external service, creating a real confidentiality and compliance risk even if the behavior is part of the product design.

External Transmission

Medium

• Category: Data Exfiltration

Content

def _post_json(base_url: str, path: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
    url = f"{base_url}{path}"
    try:
        res = requests.post(url, json=payload or {}, timeout=DEFAULT_TIMEOUT)
        res.raise_for_status()
        data = res.json()
        if not isinstance(data, dict):

• Confidence: 90% confidence
• Finding: The module performs outbound POST requests to a Browser Service endpoint derived from explicit input or the BROWSER_SERVICE_URL environment variable, with no validation of scheme, host, or trust boundary. If an attacker can influence that configuration, searches, product URLs, and browser actions could be redirected to an attacker-controlled service, enabling SSRF-like behavior, workflow hijacking, or leakage of user activity to an untrusted endpoint.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), which makes builds non-reproducible and can silently pull in unexpected versions over time. In a security-sensitive skill, unpinned dependencies increase supply-chain risk and can also allow resolution to a version with known vulnerabilities if constraints elsewhere force that outcome.

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The requirement permits installation of `requests==2.31.0`, a version with multiple published advisories. Although the specifier is not hard-pinned to 2.31.0, allowing that version means some environments or dependency resolutions could still select a vulnerable release, exposing the skill to issues such as credential leakage or request verification flaws depending on usage.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_product_pick_package.py:28