idea to product mvp

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:59 AM UTC
• Version: 1.0.18

Overview

This skill mostly matches its product-research purpose, but it stores sensitive local data and reusable login sessions with weak consent and protection controls.

Install only if you are comfortable with a skill that can write persistent local profile data, store API/SMTP credentials, send emails on request, install browser automation dependencies, and reuse a logged-in Xiaohongshu browser session. Use a dedicated account for browser automation, keep .skills-data out of version control and backups, restrict file permissions, clear the browser cache when done, and avoid running the WeChat search script until TLS verification is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/search_wechat.py:65

Finding

TLS Certificate and Hostname Verification Disabled for Sogou Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/search_wechat.py, lines 65–67
Vulnerability Type: Improper certificate validation
Risk Level: High

python

_ssl_ctx = ssl.create_default_context()
_ssl_ctx.check_hostname = False
_ssl_ctx.verify_mode = ssl.CERT_NONE

The unsafe TLS context is subsequently supplied to Sogou requests, including calls at lines 98, 139, and 358–362.

Technical Analysis

The code explicitly disables both certificate-chain validation and hostname verification. Consequently, HTTPS connections made with _ssl_ctx accept certificates that are self-signed, expired, issued for another hostname, or supplied by an untrusted party.

This defeats the authenticity guarantees of TLS. Although traffic remains encrypted against passive observers, an active network attacker can terminate the connection using an arbitrary certificate and provide attacker-controlled responses.

The affected responses are parsed as search results, cookies, and redirect information. Therefore, an attacker could manipulate research content saved by the Skill or intercept and replace Sogou session cookies. This behavior is unnecessary for the declared search functionality because Python's default verified TLS context should be used.

Attack Path

1. The user runs the WeChat search script on an attacker-controlled or compromised network.
2. The attacker intercepts a request to a Sogou HTTPS endpoint.
3. The attacker presents an arbitrary certificate for the intercepted connection.
4. The script accepts the certificate because certificate and hostname verification are disabled.
5. The attacker returns forged HTML, cookies, or redirect headers.
6. The script parses the forged data and may save attacker-controlled search results under .skills-data/idea2mvp/data/search-results/.
7. Subsequent Agent analysis may treat the manipulated content as legitimate market-research evidence.

Impact Assessment

An active network attacker can compromise t ...[truncated 402 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the assignments to check_hostname and verify_mode.
• Use the verified default context:

python

_ssl_ctx = ssl.create_default_context()

• Do not implement a fallback that disables verification after a certificate error.
• If a private certification authority is legitimately required, load only that authority through load_verify_locations.
• Validate that resolved redirect URLs use HTTPS and belong to an explicit allowlist such as mp.weixin.qq.com.
• Add automated tests confirming that self-signed certificates and hostname mismatches are rejected.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/xiaohongshu_search.py:140

Finding

Reusable Authenticated Browser Session Persisted Without Explicit Protection or Cleanup

Content

View full analysis

Vulnerability Details

File Location: scripts/xiaohongshu_search.py, lines 140–164
Vulnerability Type: Insecure storage of authentication state
Risk Level: Medium

python

async def _launch_browser():
    from playwright.async_api import async_playwright

    pw = await async_playwright().start()
    os.makedirs(BROWSER_DATA_DIR, exist_ok=True)

    vw = random.randint(1260, 1400)
    vh = random.randint(850, 950)

    context = await pw.chromium.launch_persistent_context(
        user_data_dir=BROWSER_DATA_DIR,
        headless=False,
        viewport={"width": vw, "height": vh},
        locale="zh-CN",
        timezone_id="Asia/Shanghai",
        user_agent=(
            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) "
            "AppleWebKit/537.36 (KHTML, like Gecko) "
            "Chrome/131.0.0.0 Safari/537.36"
        ),
        args=[
            "--disable-blink-features=AutomationControlled",
            "--disable-features=IsolateOrigins,site-per-process",
        ],
    )

The profile path is defined at line 36:

python

BROWSER_DATA_DIR = os.path.join(CACHE_DIR, "xhs_browser_data")

The code confirms that the profile contains a reusable login cookie at lines 188–189:

python

cookies = await page.context.cookies()
has_session = any(c["name"] == "web_session" and c["value"] for c in cookies)

Closing the browser context at lines 525–526 does not delete the persistent profile:

python

await context.close()
await pw.stop()

Technical Analysis

Playwright's launch_persistent_context stores cookies, local storage, browser databases, and related authentication state in the specified profile directory. The Skill intentionally reuses that profile so the user does not need to scan a login code for every execution.

The directory is created using default process permissions. No explicit 0700 permission is applied, and no cleanup, logout, expiration, or session-deletion function is provided. Closing the cont ...[truncated 1366 chars]

Remediation

View remediation

Remediation Suggestions

• Use a temporary browser profile by default and delete it after execution.
• If persistent login is desired, require explicit user opt-in before retaining session state.
• Create the browser profile directory with mode 0700.
• Verify and correct permissions on existing profile directories before launch.
• Provide a command that clears cookies and securely removes the persisted profile.
• Clearly disclose where authentication state is stored and how long it is retained.
• Prefer a dedicated automation account with minimal privileges rather than the user's primary account.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils.py:81

Finding

Credential-Bearing Environment File Created Without Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/utils.py, lines 81–90
Vulnerability Type: Insecure local secret storage
Risk Level: Medium

python

def ensure_dirs():
    """Ensure the runtime data directory structure exists."""
    for d in (SKILL_DATA_DIR, DATA_DIR, SEARCH_RESULTS_DIR, CACHE_DIR, LOGS_DIR):
        os.makedirs(d, exist_ok=True)


def ensure_env_file():
    """Ensure the environment file exists, creating a template when absent."""
    ensure_dirs()
    if os.path.exists(ENV_FILE):
        return
    with open(ENV_FILE, "w", encoding="utf-8") as f:
        f.write(ENV_TEMPLATE)

The file is designed to contain PRODUCTHUNT_TOKEN, GITHUB_TOKEN, EMAIL_SENDER, and EMAIL_PASSWORD.

Technical Analysis

The .env file and its parent directories are created using ordinary os.makedirs and open calls. Their effective permissions depend entirely on the process umask. Under a permissive umask, the file may be readable by other local users.

The code also returns immediately when an existing file is found, so it never checks or repairs insecure permissions. Because the file is explicitly intended to store API and SMTP credentials, relying on ambient process settings is insufficient.

Attack Path

1. The Skill creates .skills-data/idea2mvp/.env under a permissive process umask.
2. The resulting file is readable by users other than its owner.
3. The user adds Product Hunt, GitHub, or SMTP credentials.
4. Another local account or process reads the file.
5. The exposed credentials are reused against their corresponding services.

Impact Assessment

The obtainable privileges depend on the credentials placed in the file:

• A Product Hunt token may permit authenticated API use within its assigned scope.
• A GitHub token may expose repository or account capabilities granted to that token.
• SMTP credentials may permit sending email as the configured account and could expose mailbox-related capabilities depending on th ...[truncated 161 chars]

Remediation

View remediation

Remediation Suggestions

• Create the runtime root directory with mode 0700.
• Create .env atomically with mode 0600, for example by using os.open with O_CREAT | O_EXCL and an explicit mode.
• Apply os.chmod(ENV_FILE, 0o600) after creation as defense in depth.
• On every load, inspect the file mode and reject or repair group/world-readable permissions.
• Reject symbolic links for the credential file to prevent writing to or reading from an unintended target.
• Recommend narrowly scoped API tokens and provider-specific SMTP authorization codes.
• Add .skills-data/ to source-control ignore rules, while clarifying that this does not replace filesystem access controls.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:131

Finding

Mutable Third-Party Tools and Browser Components Installed Without Version Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 131
Vulnerability Type: Unpinned executable dependency installation
Risk Level: Medium

bash

npx skills add https://github.com/vercel-labs/agent-browser --skill agent-browser

Additional unpinned installation instructions appear in references/find-ideas.md at line 39 and scripts/xiaohongshu_search.py at lines 18 and 626–627:

bash

pip3 install playwright && python3 -m playwright install chromium

Technical Analysis

The Skill directs the Agent to install and execute third-party components without pinning an exact package version, immutable Git commit, browser revision, lockfile, or integrity hash.

The GitHub installation command references a mutable repository state. The Python package installation resolves the current package release, while the Playwright browser command downloads an associated browser binary. The effective executable content can therefore change after this Skill has been audited.

No evidence shows that the current upstream projects are malicious. The vulnerability is the unbounded trust placed in mutable external dependencies and the absence of reproducible integrity controls.

Attack Path

1. An upstream repository, package account, release process, or distribution channel is compromised or changes unexpectedly.
2. The user invokes functionality requiring agent-browser or Playwright.
3. The Agent follows the bundled installation instruction.
4. The package manager retrieves the current mutable upstream content rather than a reviewed version.
5. Installation hooks, package code, Skill instructions, or downloaded browser components execute with the Agent process's privileges.
6. Malicious upstream code can access files, environment variables, network resources, and credentials available to that process.

Impact Assessment

A compromised dependency could execute arbitrary code with the same operating-system privileges as the Agent or u ...[truncated 341 chars]

Remediation

View remediation

Remediation Suggestions

• Pin agent-browser to a reviewed immutable Git commit rather than a repository branch or default revision.
• Pin Playwright to an exact version.
• Use a lockfile and package hashes where supported.
• Record and verify the expected browser revision or artifact checksum.
• Review external Skill instructions before installation because they can affect Agent behavior in addition to executing code.
• Require explicit user approval immediately before installing executable third-party components.
• Install dependencies in an isolated virtual environment or container with minimal filesystem and credential access.
• Periodically update pinned versions through a documented review process rather than resolving latest versions at runtime.

other

Note

• Location: SKILL.md:134

Finding

User Behavioral Profile Persisted Across Sessions Without Explicit Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 134–153
Vulnerability Type: Non-consensual persistent privacy profiling
Risk Level: Low

The Skill instructs the Agent to maintain a persistent profile containing the user's technical background, industry experience, perceived knowledge level, available time and budget, decision style, and risk preferences.

The relevant instruction at line 152 states, translated into English:

text

Whenever new user background information is inferred from the conversation,
append and update it promptly without requesting the user's consent.

The profile is stored at:

text

.skills-data/idea2mvp/data/user-profile.md

Technical Analysis

The behavior is related to adapting product and technical recommendations, but it exceeds data minimization by persistently recording inferred personal and behavioral attributes without affirmative consent.

The profile is reused across later sessions. No retention limit, automatic deletion mechanism, review workflow, field-level minimization, or explicit permission requirement is defined. The instructions also permit subjective inferences about knowledge and decision style rather than limiting storage to facts directly supplied for the current task.

No code was found that automatically transmits this profile to an external server. The risk is persistent local collection and later reuse or disclosure.

Attack Path

1. During an ordinary conversation, the user reveals or implies information about experience, employment, budget, available time, or preferences.
2. The Agent infers additional attributes such as technical level, decision style, or risk tolerance.
3. The Agent appends those attributes to user-profile.md without requesting consent.
4. The profile remains available across future sessions.
5. Another process, user, backup recipient, repository archive, or later Agent interaction obtains or uses the stored profile outside the context in which th ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit opt-in before creating or updating a persistent user profile.
• Explain what fields will be stored, why they are needed, and how long they will be retained.
• Store only facts necessary for the declared workflow.
• Avoid subjective classifications such as perceived cognitive level or decision style unless the user explicitly requests them.
• Present proposed profile updates for user review before writing them.
• Provide commands to view, correct, export, and delete the profile.
• Define a retention period and automatically remove expired profile data.
• Protect the profile file with mode 0600 and its parent directory with mode 0700.
• Keep session-only personalization in transient conversation context when persistence is unnecessary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Unlike the other TP4 items, this one includes automated login/session use on XiaoHongShu via browser automation, which is materially more sensitive than a simple description mismatch. The skill advertises broad research assistance but embeds instructions to use persistent browser session data and simulated login behavior, which expands privacy and account-abuse risk if invoked without strong user awareness and consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- **Skill 源码**（`SKILL.md`、`scripts/`、`references/`）保持不可变，可安全分享和版本管理。

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to update user profile data 'without needing user consent' is a direct privacy and data-governance problem. It authorizes persistent collection of conversation-derived personal data without transparency or control, which is especially risky in a skill that may gather business interests, technical ability, and decision-making traits over time.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

- **`scripts/send_email.py`** — 通过 SMTP 发送邮件通知。可将搜索报告或任意文本内容发送到指定邮箱。支持从 `--body`、`--file`（多文件合并）或 stdin 传入内容。需在 `.skills-data/idea2mvp/.env` 中配置 `EMAIL_SMTP_HOS

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Disabling TLS verification without any user warning means every outbound HTTPS request trusts unauthenticated servers. In this skill's context, that can silently corrupt market-research results and expose downstream users to spoofed article links, especially because the script fetches and follows content from external sites.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/producthunt_trending.py (reported line 177)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 8)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 28)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 232)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 256)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_email.py (reported line 311)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils.py (reported line 8)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils.py (reported line 44)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils.py (reported line 85)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils.py (reported line 99)May include surrounding context.

python

统一管理 skill 的运行时数据目录结构（遵循 .skills-data 规范）：

    <project_root>/.skills-data/idea2mvp/
        .env            — 配置文件（Token、偏好、邮件等）
        data/           — 持久化数据
            search-results/ — 各平台搜索结果（ph_results.txt、github_results.txt 等）
            user-profile.md、idea-brief/、报告等

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/utils.py (reported line 41)May include surrounding context.

python

LOGS_DIR = os.path.join(SKILL_DATA_DIR, "logs")

# 配置文件
ENV_FILE = os.path.join(SKILL_DATA_DIR, ".env")

# ---------------------------------------------------------------------------
# .env 模板

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes capabilities that involve reading environment/configuration, reading and writing files under a project directory, and making network requests, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an overbroad trust boundary: an agent may invoke more powerful tools than users expect, especially because the workflow also includes persistent storage and external communication.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to match common requests like market research, send email, or build MVP, which can cause the skill to activate in contexts where the user did not intend persistent storage, scraping, or external communication. Overbroad activation increases the chance of unintended data collection and tool use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file states '全程使用中文输出', which imposes a fixed language policy. This is a natural-language policy violation because it does not provide opt-in, choice, or a documented region-specific justification for restricting the interaction language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.