T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:457- Finding
Explicit Bypass of Browser SSRF Protections
- Content
View full analysis
- Remediation
View remediation
Security audit
进口产品核查
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate product-checking purpose, but it directs automatic retention of sensitive evidence and suggests bypassing browser SSRF protections with curl.
Review before installing. The skill is useful for import-product due diligence, but only use it if you are comfortable with local evidence packages being created under your home directory and with public-site lookups. Do not allow curl/direct-IP checks of QR-code links; blocked destinations should stay blocked. Redact receipts, payment records, addresses, and account details, and delete evidence packages when finished.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:212- Finding
Automatic Persistence of Sensitive User Evidence Without Consent or Retention Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly requires automatic saving of user photos, receipts, and payment-related records but does not provide a prominent, centralized user notice or consent step. Because these materials may contain personal and financial information, silent collection and retention creates a meaningful privacy and compliance risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The evidence-package workflow automates directory creation, screenshot capture, and persistent archiving of user and merchant materials without a single prominent consent gate. This turns an informational investigation skill into a structured retention pipeline for sensitive documents, increasing privacy exposure and the blast radius of any compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
L004 的显示名及整份 SKILL.md 均以中文编写，并通过固定中文输出模板要求生成报告、摘要和分享文案，但未见任何用户语言偏好选择或可切换说明。对于通用技能，这会构成默认强制特定语言/locale 的自然语言策略问题。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
L074-L077 的文字触发规则包含“查一下这个产品”“帮父母查一下他们买的XX保健品”等常见日常表达，且其中后者还被标注为“默认进口导向”。这些短语在普通咨询、比价或一般商品讨论中也很常见，缺少足够的进口场景约束，容易与非目标请求重叠。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
L090-L094 使用“用户质疑是不是假洋牌”“用户买了进口产品后发现异常”“用户调查境外供应链”等高层场景直接触发本 skill，但未说明何种证据或关键词才算满足条件，也缺少不应触发的相邻场景说明。这样的场景式描述容易让普通消费咨询或泛化的供应链问题被路由到本技能。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to automatically save user-uploaded product photos and other investigation artifacts into a local evidence package, which expands behavior from analysis into persistent data handling. This creates unnecessary retention of potentially sensitive user data and merchant documents without clear consent, scope limits, or deletion controls.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Saving user photos, receipts, payment records, and merchant documents into a local evidence package establishes a default retention flow for sensitive data. Even if intended for consumer-rights support, default archival materially increases the chance of overcollection, unauthorized access, and secondary use beyond the immediate task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill directs use of curl-based requests and shell-style operations outside the narrowly described 'public platform investigation' workflow. Broadening the execution surface increases risk of uncontrolled network access and behavior that may bypass normal tool safeguards or logging expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow operationalizes persistent collection of screenshots, customs forms, receipts, and other supporting files in a local directory structure, which is a concrete data-retention mechanism rather than a transient analysis step. This creates a broader repository of sensitive materials that may outlive the user interaction and be exposed later.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The explicit instruction to create a persistent directory under the user's home path introduces session persistence beyond what is required for a single investigation. Persistent local state can accumulate sensitive case files across sessions, increasing confidentiality risk and making later unauthorized reuse or exposure more likely.
- Content
用户发送产品包装照片时 → 立即保存到
01_产品包装/,无需等待后续步骤。bash mkdir -p ~/.qclaw/workspace/证据包_$(date +%Y-%m-%d)/01_产品包装Step 2-6(查询时):browser 截图实时保存
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The privacy guidance says reports should be for personal rights protection and not broadly shared, but elsewhere the skill tells the agent to automatically retain user images, receipts, payment records, and screenshots locally. This inconsistency is dangerous because it may mislead users into believing their data is handled minimally while the skill actually archives it persistently.
- Content