lingxiao-ops-diagnosis

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed e-commerce operations calculator that connects to a remote Lingxiao MCP service, with no evidence of hidden local access, persistence, or destructive behavior.

Install only if you are comfortable sending the entered pricing, cost, shipping, refund, country, and related commercial parameters to Lingxiao's remote MCP service. Avoid submitting store credentials, customer records, unreleased confidential product plans, or sensitive account data unless you have reviewed the provider's terms and privacy practices.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Remote MCP Service Introduces an Unverifiable Trust Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The skill instructs users to configure an externally hosted MCP server:

json

{ "mcpServers": { "lingxiao": { "url": "https://www.lingxiaochuhai.com/mcp" } } }

Technical Analysis

The remote MCP endpoint is integrated without version pinning, integrity verification, a fixed tool schema, capability restrictions, or documented data-handling safeguards. Unlike locally audited code, the tools, descriptions, responses, and behavior exposed by this endpoint can be changed by its operator after the skill has been reviewed.

The surrounding instructions state that the service supports anonymous, IP-limited use and encourage submitting commercial parameters such as product costs, prices, weights, shipping costs, target countries, affiliate rates, refund rates, and after-sales costs. The document does not explain retention, secondary use, confidentiality protections, or whether prompts and tool arguments are logged.

This finding does not establish that the current endpoint is malicious. No remote code execution, local privilege escalation, credential theft, or destructive behavior was demonstrated. The risk arises from treating a mutable third-party service as a trusted dependency without controls that allow users or clients to verify its capabilities and behavior.

Attack Path

1. A user copies the supplied MCP configuration into an MCP-capable client.
2. The client connects to the external endpoint and retrieves tool metadata controlled by the remote service.
3. The agent sends e-commerce pricing, cost, logistics, market, refund, or after-sales inputs to that service.
4. The service receives those inputs and controls the calculation results returned to the agent.
5. If the service is compromised or its behavior changes, it could collect commercially sensitive inputs, return man ...[truncated 1060 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish and pin a versioned MCP API and tool schema so audited behavior cannot change silently.
2. Restrict the integration to explicitly named, calculation-only tools such as profit_estimate and etsy_fee_estimate.
3. Require clients to reject unexpected tools, capability changes, or requests for filesystem, shell, credential, browser, or account access.
4. Document every field transmitted to the service, along with logging, retention, deletion, sharing, and confidentiality policies.
5. Add a clear warning not to submit customer records, store credentials, unreleased product information, or other confidential business data.
6. Require explicit user confirmation before each external submission and display the destination host and transmitted fields.
7. Provide a locally auditable calculator or reproducible open-source implementation for users who cannot disclose commercial data.
8. Add integrity controls where supported, such as signed tool manifests, certificate validation, schema hashes, and change notifications.
9. Document that anonymous access exposes the user's IP address and clarify any rate-limiting or analytics practices associated with it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.