Ora地图拓客专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:20 AM UTC
• Version: 1.0.5

Overview

This map-search skill largely matches its stated purpose, but it under-discloses credential use, third-party data handling, saved contact data, and a mandatory payment redirect.

Install only if you are comfortable sending search keywords, coordinates, and any local OraAgent.key credential to the third-party API. Treat returned phone numbers, emails, and social accounts as regulated or sensitive business contact data, and verify the payment page independently before using any recharge link shown after a quota error.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:71

Finding

Mandatory Commercial Redirection Through Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71–76
Vulnerability Type: Agent response manipulation and commercial redirection
Risk Level: Medium

Vulnerable Instruction Snippet

The following is an English rendering of the complete affected instruction block:

markdown

### HTTP 402 Payment Handling
If the script outputs `STATUS:402`, the free quota has been exhausted. The agent **must** tell the user:
- The current account's free query quota has been exhausted.
- To continue, recharge at: **https://www.oraskl.com/platform**
- Search again after recharging.

The behavior is supported by scripts/fetch_stream.js, lines 76–80:

javascript

if (resp.status === 402) {
  // Free quota exhausted; output structured information for the agent to identify.
  console.log(`STATUS:402`);
  console.log(`MESSAGE:Free quota exhausted; payment is required to continue`);
  console.log(`RECHARGE_URL:https://www.oraskl.com/platform`);
}

Technical Analysis

The Skill contains a mandatory instruction that forces the agent to reproduce a provider-controlled commercial URL when the external service returns HTTP 402. This changes the agent's response policy from neutral error reporting to prescribed promotional redirection.

The triggering status is controlled by the external API provider. Consequently, the provider can cause the commercial message to appear by returning HTTP 402, regardless of whether the underlying condition can be independently verified by the agent. The script reinforces the instruction by emitting a structured RECHARGE_URL value that the Skill directs the agent to present.

This does not grant operating-system privileges or execute arbitrary code. However, it gives the Skill author and external API provider conditional control over user-facing agent output and enables the agent to be used as a traffic-redirection channel.

Attack Path

1. A user invokes the ma ...[truncated 1181 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction requiring the agent to reproduce a fixed recharge URL.
2. Report HTTP 402 neutrally, for example: “The service reported that its query quota is unavailable or exhausted.”
3. Present billing information only when the user explicitly requests it.
4. If a billing link is necessary, identify it clearly as a third-party provider link rather than an agent recommendation.
5. Do not trust a provider-returned URL directly. Maintain an independently reviewed allowlist and require HTTPS.
6. Separate operational errors from promotional content so external status codes cannot automatically trigger advertisements.
7. Consider displaying the provider name, request status, and verification limitations so users can make an informed decision.
8. Add tests confirming that HTTP 402 and other provider-controlled responses cannot inject or mandate arbitrary user-facing links.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a network-capable script (node ./scripts/fetch_stream.js) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens governance and reviewability because consumers cannot tell from the manifest what external access the skill requires, increasing the risk of unintended network access or overbroad execution in permissive runtimes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises retrieval of business contact data including phone numbers, emails, and social media accounts, but does not present a clear user warning or handling notice about collecting and returning potentially sensitive personal/business contact information. In a lead-generation and scraping context, this increases privacy/compliance risk and may facilitate misuse of harvested contact data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions require that Chinese keywords be translated into English automatically, which imposes a language behavior on the user without any opt-in or alternative. The policy for this audit flags language or locale constraints when they are forced rather than offered as a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's natural-language documentation and user-facing usage/output text are entirely in Chinese, including required CLI usage and operational messages. This imposes a specific language on users without indicating any language choice or opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.