T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
Complete Advertising Reports Are Transmitted to an External Service Without Documented Privacy Controls
- Content
View full analysis
## 准备报表 后台导出的搜索词报告是 xlsx，**先另存为 CSV** 再读进来——xlsx 是二进制，粘不进字段。 ``` ads_waste_check({ reportText: "", filename: "SearchTerm_US.csv" }) ``` ``` ### Technical Analysis The Skill instructs the user or agent to submit the complete contents of an Amazon advertising search-term report to the externally operated MCP endpoint at `https://www.lingxiaochuhai.com/mcp`. These reports may contain commercially sensitive information, including search terms, campaign or advertising-group structure, advertising spend, clicks, attributed orders, sales performance, and related business metrics. Although the document states that no store authorization is required, anonymous access does not make the report transmission private. The stated per-IP request quota also indicates that the service processes client network metadata. The Skill does not document: - Which report columns are required or can be removed. - How long uploaded reports and request metadata are retained. - Whether uploaded data is used for analytics, profiling, or model training. - Who can access the submitted data. - Whether users can request deletion. - Whether report content is encrypted or protected after receipt. - Whether explicit user confirmation is required immediately before transmission. This is a data-minimization and disclosure-control weakness rather than evidence that the external operator is malicious. ### Attack Path 1. A use ...[truncated 1324 chars]- Remediation
View remediation