Ora社媒主页搜索专家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:27 AM UTC
• Version: 1.0.7

Overview

This skill matches its social-media lookup purpose, but it reads a local auth token, sends business queries to an external API, logs part of the token, and injects recurring payment links into responses.

Review before installing. Use only a token intended for this service, avoid submitting confidential lead lists or regulated customer data, and treat upgrade/renewal links in responses as provider-supplied commercial links. Operators should remove token-prefix logging, validate the payment URL, add a privacy notice, and escape or validate API-returned Markdown fields.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:102

Finding

Mandatory Commercial Content Injection into Agent Responses

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: handlers/ora_sns_pro_handler.js:30

Finding

Unvalidated Configurable Payment URL Rendered as a Trusted Markdown Link

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: tools/ora_sns_pro_api.js:177

Finding

Authentication Token Prefix Disclosed in Application Logs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: handlers/ora_sns_pro_handler.js:177

Finding

Untrusted API Response Fields Rendered as Unescaped Markdown

Content

View full analysis

150 ? d.keywords.substring(0, 150) + '...' : d.keywords; content += ` - 🏷️ 标签: ${kw}\n`; } if (d.description) { const desc = d.description.length > 200 ? d.description.substring(0, 200) + '...' : d.description; content += ` - 📝 简介: ${desc}\n`; } content += `\n`; } ``` The domain-result formatter repeats the same pattern: ```js for (let i = 0; i < item.data.length; i++) { const d = item.data[i]; content += `- **${d.title || '未命名'}**\n`; content += ` - 🔗 社媒主页: ${d.social_media_url || '-'}\n`; if (d.url) { content += ` - 🌐 官网: ${d.url}\n`; } if (d.country_tag) { content += ` - 🇺🇸 国家: ${d.country_tag.toUpperCase()}\n`; } if (d.keywords) { const kw = d.keywords.length > 150 ? d.keywords.substring(0, 150) + '...' : d.keywords; content += ` - 🏷️ 标签: ${kw}\n`; } if (d.description) { const desc = d.description.length > 200 ? d.description.substring(0, 200) + '...' : d.description; content += ` - 📝 简介: ${desc}\n`; } content += `\n`; } ``` ### Technical Analysis The remote API controls `title`, `social_media_url`, `url`, `country_tag`, `keywords`, and `description`. These values are ins ...[truncated 1806 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill performs outbound network requests to third-party APIs but does not declare an explicit tool scope such as allowed-tools or permissions. That mismatch weakens reviewability and runtime least-privilege controls, making it easier for a skill with network capability to be installed or trusted without a clear disclosure of what it can access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to read a local AuthToken from ../../OraAgent.key without an explicit warning that local credentials/configuration will be accessed. Accessing local secret material is sensitive because it expands the skill's trust boundary and may expose or misuse credentials if the environment or skill execution model is broader than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs sending user-supplied company names, domains, and keywords to external APIs without an explicit privacy notice or consent checkpoint. Users may unknowingly disclose sensitive lead lists, customer targets, or proprietary research terms to a third party, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill is designed to transmit user queries and authentication headers to an external API endpoint, which is a real external data transmission risk. In this context the transmission is core functionality, but it remains security-relevant because it sends potentially sensitive business queries off-platform and relies on a third-party service boundary.

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

console.log(完成: ${succeeded} 成功, ${failed} 失败);

text

### curl 调用示例

```bash
# 关键词搜索（keyword 应为英文，如用户输入中文请先翻译）

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README documents sending user-supplied keywords, company names, and domains to third-party API endpoints but does not disclose that this data leaves the local environment or warn about privacy, confidentiality, or data-handling implications. In a lead-generation/social-media lookup skill, users may submit sensitive prospecting targets, client names, or internal research terms, so the omission can cause unintended external disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The handler's comments and runtime messaging state that Chinese queries should be translated to English because the data source is mainly English. This creates a language-handling policy issue because the skill nudges or defaults users toward a specific language rather than offering a neutral language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The logic sets _needsChineseTranslation whenever keywords contain Chinese and the user did not explicitly request Chinese search. This effectively imposes an English-preferred locale behavior without an affirmative user opt-in, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Both the fallback keyword branch and batch keyword branch log that Chinese keywords need to be translated to English before querying. This repeats the same language policy issue across alternate parsing paths, showing the behavior is systematic rather than incidental.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest name and user-facing changelog entries are presented exclusively in Chinese, but the file does not document that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language instructions state that keywords should be in English and that Chinese input should be translated before calling the method. This imposes a language constraint in the skill behavior without presenting it as an optional user choice or documenting a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.