Security audit

蓝鲸选品助手-text

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its marketplace-analysis purpose, but its optional HTML mode is under-disclosed because the code attempts to save full results and open them in a browser despite saying it will not.

Install only if you are comfortable with a skill that can use your LJXP API token to query commercial marketplace data. Prefer LJXP_TOKEN over --token, avoid HTML output unless you specifically want browser rendering, and delete generated ljxp_search HTML files if they contain sensitive business research.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The docstring explicitly says the function no longer auto-opens a browser, but the implementation still writes attacker-influenced API data into HTML and launches it with the local browser. That mismatch is dangerous because callers may rely on the documented safer behavior, while the actual code triggers active content rendering in a richer execution environment and can expose sensitive business data or enable script execution depending on the template.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The docstring explicitly says the function no longer opens a browser to avoid exposing sensitive business data or loading active content, but the implementation still writes attacker- or API-controlled data into HTML and launches it with webbrowser.open(). If the template renders injected data unsafely, this can trigger local script execution in the browser context, data exposure, or unintended outbound requests, and the misleading documentation increases the chance users invoke it assuming it is safe.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The documentation shows passing an API token directly on the command line (`--token <TKN>`) without warning that command-line arguments may be exposed through shell history, process listings, logging, or shared terminal transcripts. In this skill's context, the token grants access to a commercial data API, so accidental disclosure could enable unauthorized API use or data access, even though the issue is documentation hygiene rather than active exfiltration.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The documentation includes command examples that pass an API token directly on the command line (`--token <TKN>`), but provides no warning that command-line arguments may be exposed through shell history, process listings, logs, or screenshots. This can lead to accidental credential disclosure, especially in shared environments or recorded troubleshooting sessions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The function persists full API response data and search parameters to a local HTML file using delete=False, which can leave sensitive operational or commercial data on disk beyond the user's awareness. In a skill context handling marketplace analytics, this may include business intelligence, seller/item details, and search history that could be accessed later by other local users, backup systems, or forensic tooling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code automatically opens the generated file in a browser despite comments warning that it should not. This can unexpectedly disclose sensitive result data to browser components, extensions, sync/history systems, or execute active content derived from API data/template content without the user's informed consent.

Static analysis

No suspicious patterns detected.