双色球选号系统 v2

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:51 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed Chinese lottery number helper that installs common Python libraries, reads public/local draw data, and writes local result files.

Install only if you are comfortable with an automatic pip install of unpinned Python packages and with the update script contacting a public lottery-data website. Treat generated numbers as entertainment or analysis only, not financial advice or a winning prediction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Dependencies Installed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-13
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

json

"install": [
  {
    "id": "python-deps",
    "kind": "exec",
    "command": ["pip3", "install", "-q", "requests", "beautifulsoup4"],
    "label": "Install Python dependencies for lottery-ssq"
  }
]

Technical Analysis

The Skill automatically installs requests and beautifulsoup4 without pinning exact versions or verifying package hashes. Consequently, the code reviewed during this audit does not fully determine which dependency artifacts will be installed in future executions.

Package installation can execute package build hooks or other installation-time code with the privileges of the account running the Skill installer. If a package release, transitive dependency, configured package index, or resolved distribution is compromised, attacker-controlled code could run during installation.

The audit found no evidence that the named packages or currently installed versions are malicious. This finding concerns the absence of dependency integrity and reproducibility controls rather than a confirmed compromise.

Attack Path

1. An attacker compromises a dependency release, a transitive dependency, or the package index used by pip3.
2. A user installs the Skill, causing the declared exec installation action to run.
3. pip3 resolves mutable package versions because no exact versions, lock file, or hashes are specified.
4. The malicious distribution is downloaded and installed.
5. Attacker-controlled installation hooks or imported package code execute under the installer or runtime account.
6. The attacker obtains access to files, network resources, and other capabilities available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user or service account installing or running the Skill. The a ...[truncated 378 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version.
2. Resolve and lock all transitive dependencies.
3. Record cryptographic hashes for every permitted distribution.
4. Install from a reviewed requirements file using hash enforcement:

bash

python3 -m pip install --require-hashes -r requirements.txt

5. Use an isolated virtual environment rather than modifying a shared Python environment.
6. Restrict installation to a trusted package index and disable unintended fallback indexes.
7. Prefer prebuilt, reviewed wheels where practical to reduce exposure to arbitrary build hooks.
8. Run dependency vulnerability and provenance checks during release preparation.
9. Perform installation and execution under a dedicated, least-privileged account without access to unrelated credentials or sensitive files.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full number-selection assistant driven by historical probability analysis and multiple filtering/strategy modules. However, this code chunk only fetches historical 双色球 results from 500.com, extracts structured draw data, deduplicates/sorts it, and saves it as CSV. That can serve as supporting data collection for such a system, but by itself it does not perform the core described behaviors: no probability optimization, no hot/cold or AC/span/tail analysis, no blue-ball modeling, and no generation of recommended bets. Therefore the code’s actual primary purpose is materially narrower and different from the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares executable installation steps and references scripts that imply file read/write and network access, but it does not define any explicit tool scope such as permissions or allowed-tools. This creates unnecessary ambiguity about what the skill may access at runtime, increasing the risk of overbroad execution in environments that rely on manifest scoping for containment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The JSON hard-codes the lottery name as the Chinese term "双色球", which implies a fixed language/locale in user-facing data. There is no indication elsewhere in the file that users can opt into this locale or select an alternative language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings and documentation that assume a specific language/locale. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints all runtime status and result messages in Chinese only. This forces a locale choice on users without opt-in and is not documented here as a justified regional restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.