Security audit

猪八戒网官方技能

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ZBJ marketplace integration, but it can make high-impact account and payment-related changes without built-in confirmation and can send the API key to a configurable endpoint.

Install only if you are comfortable giving an agent a ZBJ API key that can perform the specific demand, order, seller-selection, evaluation, and payment-link actions granted to that key. Use a dedicated least-privilege API key, keep ZBJ_API_URL on the official endpoint unless you fully control the target, and manually confirm every publish, close, winner-selection, evaluation, or payment-related action before allowing it to run.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: bridge.js:11
Finding: Configurable API Endpoint Can Exfiltrate the ZBJ API Key
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:8
Finding: Dependency Installation Is Not Locked to a Reproducible Version
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill exposes actions such as publishing demands, selecting winners, closing demands, closing orders, and evaluating sellers, and the documentation demonstrates these operations as straightforward tool calls without emphasizing confirmation requirements or irreversibility. In an agent setting, this increases the risk of unintended marketplace transactions or workflow changes caused by ambiguous prompts, automation mistakes, or prompt injection through user content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Several mapped tools perform irreversible or high-impact business actions such as closing demands, pausing/opening demands, eliminating sellers, selecting winners, and publishing modifications, but the bridge forwards requests directly with no confirmation, safeguard, or policy check. In an agentic context, this makes accidental, prompt-induced, or unauthorized state changes much easier, especially because the bridge is explicitly designed to execute remote actions over the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Order-management actions such as evaluating sellers, closing orders, and requesting trusteeship payment URLs are executed immediately once invoked, with no user-visible disclosure or confirmation in this bridge. Because these operations can affect financial flows, reputational outcomes, or order state, the lack of a human-in-the-loop control materially increases the risk of harmful agent misexecution or abuse.
Content: No source excerpt is available for this finding.

Lp4

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The package description is written as '官方技能 - 一站式服务交易平台集成' with no indication that the skill supports other languages or that Chinese-only behavior is an intentional, documented regional limitation. For a manifest file, this can indicate a language/locale policy issue if the skill is presented as generally applicable but implicitly restricted to one language without user opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The dependency uses a caret range (^1.7.7), which allows npm to resolve newer minor and patch releases at install time. That weakens build reproducibility and can silently introduce a vulnerable or malicious upstream release, which matters more in a network-enabled MCP skill that may process user-controlled requests and remote responses.
Content: Scanner excerpt · package.json (reported line 9)May include surrounding context.
json
"author": "ZBJ", "license": "MIT", "dependencies": { "axios": "^1.7.7" } }

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The manifest references axios without an exact pinned version while public advisories exist for multiple axios releases, so the actual installed version may be affected and cannot be verified from this file alone. In a skill with outbound network access, a vulnerable HTTP client can increase risk of SSRF bypasses, request manipulation, credential leakage, or unsafe proxy handling depending on how the library is used elsewhere.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: bridge.js:11