Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed MJZJ marketplace helper that searches listings, uploads user-provided images, submits listing applications, and reads the user's own account data through MJZJ APIs.
Install this only if you intend to use MJZJ marketplace APIs and are comfortable providing MJZJ_API_KEY. Review listing details and image files before asking the agent to submit a publish application, and treat returned account/listing data as sensitive business information.
The file's operational description, trigger guidance, error messaging, and usage examples are entirely Chinese-language, which effectively forces a specific language for use of the skill. The policy allows locale constraints only when the skill offers user opt-in or clearly documents a justified region/language limitation, which is not stated here.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/pallet/groupLabels" \
-H "Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/pallet/groupLabels" \
-H "Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/pallet/groupLabels" \
-H "Content-Type: application/json"
This flow sends an Authorization bearer token to an external service and obtains a temporary upload URL for direct file transfer. While expected for the feature, it increases security sensitivity because a compromised or misconfigured skill could expose API keys or cause user-provided files and metadata to be uploaded to unintended storage if the returned putUrl/path are not tightly validated.
curl -X POST "https://data.mjzj.com/api/common/applyUploadTempFile" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
This endpoint performs an authenticated external submission that can publish marketplace content on behalf of the user account. In context, this is intended functionality, but it is security-relevant because misuse could create unauthorized listings, leak business data, or abuse the user's account if invocation lacks strong user confirmation and strict parameter validation.
curl -X POST "https://data.mjzj.com/api/palletManage/applyNew" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json" \
-d '{
This authenticated external request retrieves the user's private marketplace inventory data. Even though it matches the skill purpose, it handles account-specific information, so insufficient consent boundaries or weak secret handling could expose sensitive business records to unauthorized parties or logs.
curl -X GET "https://data.mjzj.com/api/palletManage/getPallets?onSale=true" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json"
This endpoint accesses the user's private application/review status data using a bearer token. The operation is legitimate for the skill, but any authenticated retrieval of private account data is dangerous if the token is mishandled, the response is overshared, or the action can be triggered without clear user authorization.
curl -X GET "https://data.mjzj.com/api/palletManage/getApplications" \
-H "Authorization: Bearer $MJZJ_API_KEY" \
-H "Content-Type: application/json"
No suspicious patterns detected.