T09 · Insecure Skill Coding Practices
Warning
- Location
query_product_info.py:39- Finding
Hard-Coded API Key and Captured Client Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
vipshop-product-consultant
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it embeds fixed Vipshop client identifiers and saves/distributes more reviewer metadata than users would reasonably expect.
Install only if you are comfortable with direct Vipshop API calls using embedded shared identifiers and with review/product data being written into the working directory. Prefer a version that removes fixed user/fingerprint tokens, makes saving raw responses opt-in, minimizes reviewer fields, and documents retention and locale scope.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
query_review_list.py:84- Finding
Excessive Persistence and Distribution of Review-User Metadata
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions, headings, and output expectations are all presented in Chinese, and the file does not indicate that the user can choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a policy violation unless the locale constraint is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script persists the full raw API response to disk, which can include user-generated review text, usernames, location data, image URLs, and other metadata. Storing this data without explicit notice, minimization, or access controls creates a privacy and data-handling risk because sensitive content may remain on disk longer than intended and be exposed to other local users, logs, backups, or later processing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The extracted review dataset is written to review_list.json and includes user content and metadata such as usernames, addresses, timestamps, tags, and image references. Even though this is processed output rather than the raw response, it still creates a local privacy exposure if users are not warned and if the data is retained insecurely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script embeds and transmits multiple hard-coded identifiers and tokens such as api_key, user_id, mars_cid, and tfs_fp_token in outbound requests. Even though the request uses HTTPS, storing and reusing these values in code can expose third-party credentials or tracking identifiers to anyone with code access, and can enable unauthorized API use, account linkage, or policy violations if the values are still valid.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly instructs the agent to fetch and analyze product review content through direct HTTP API calls, but it does not warn users that review text, images, and related product data will be collected and processed. This is primarily a transparency and informed-consent issue rather than an exploit primitive, but it can still create privacy, compliance, and trust risks if users are unaware of what data the skill retrieves and analyzes.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This JSON contains user-facing natural-language fields such as the product title and brand display name exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest-style JSON contains user-facing natural-language fields such as product titles, price labels, and attributes entirely in Chinese, and there is no indication that the locale is user-selectable or intentionally region-scoped. Under the policy for all file types, fixed language content can be a locale-policy issue when no opt-in or justification is provided.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The module docstring and function docstring describe querying product information, which implies retrieving and returning data. However, the implementation additionally persists both the raw response and processed product information to local JSON files at L73-L76 and L125-L127. This is a behavioral side effect not reflected in the documentation, and the docs suggest a narrower intent than the code actually performs.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The request header hard-codes "Accept-Language: zh-CN,zh;q=0.9", which imposes a specific language/locale behavior. The file does not offer any user opt-in or configuration for locale, and no region-specific compliance justification is documented in the code comments or docstrings.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The Accept-Language header is hardcoded to zh-CN,zh;q=0.9, which imposes a specific language/locale behavior. The file does not provide any opt-in, configurability, or explanation that this is intentionally region-specific, so it fits the language/locale policy-violation category.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script writes the full API response to a local JSON file without warning or consent. If the response contains account-linked metadata, behavioral identifiers, or product/review data subject to retention constraints, this can create unnecessary local data exposure and persistence beyond the user's expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON contains natural-language review content in Chinese, and the file provides no accompanying indication that the skill or dataset is limited to Chinese-language use by design. Under the policy, forcing a specific language without opt-in or justification can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This file contains natural-language user-facing content in Chinese, such as the review text at L011, but provides no indication that the language is user-selected or that the data is intentionally limited to a Chinese-language context. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This manifest-style JSON file contains user-facing text exclusively in Chinese, such as the default review summary and satisfaction strings, without indicating that the skill is region-specific or that other language/locale options are available. Under the language/locale policy rule, hard-coded user-facing locale content can be a policy concern when no opt-in or justification is present.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This JSON contains multiple user-facing strings entirely in Chinese, such as the default reputation text and keyword labels, with no indication that language selection is configurable or user-chosen. Under the natural-language policy rule, hard-coded locale-specific content can be a policy concern when the skill does not document an opt-in or justified regional scope.
- Content
Static analysis
No suspicious patterns detected.