Security audit

Aibuy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed jewelry-market lookup and gold-price helper that uses fixed external APIs, with no evidence of hidden persistence, credential access, or destructive behavior.

Install this only if you are comfortable using a Chinese-language ShuiBei jewelry shopping assistant that sends jewelry search terms to its remote inventory service and fetches live metal quotes. Treat product and price outputs as reference information, not verified purchase advice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description includes a broad first-party jewelry product lookup capability for Shenzhen Shuibei wholesale inventory and a second capability to estimate gold/K-gold product prices after product lookup. The supplied code does neither. It makes a GET request to a single quote API endpoint, parses quote data for a fixed list of metals and brand gold prices, and renders them as markdown/JSON. This does align with the third declared capability, real-time gold price querying, including brand prices and futures/spot quotes. However, the overall description claims substantially broader behavior than what this code chunk implements. There is no evidence of product catalog search, supplier comparison, jewelry browsing across categories, or price estimation formulas tied to product attributes. Therefore the description does not accurately represent this code chunk’s actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk matches the product search portion of the description: it queries a remote jewelry search endpoint using a keyword. However, nothing in this code retrieves real-time gold/silver prices, computes estimated pricing for gold/K-gold products, or handles brand/spot/Shanghai/COMEX metal price queries. So the implemented behavior is materially narrower than the declared description. There is no evidence of unrelated or malicious capabilities beyond remote access to the declared jewelry query service.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill instructs the agent to run local Python scripts that appear to fetch live market data, implying network-capable behavior, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the blast radius if the skill or its scripts are modified, because the agent may invoke broader capabilities than users or platform policy expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill says it should trigger for essentially any jewelry category and even casual browsing language, creating weak boundaries around when network/tool actions occur. In an assistant environment, this increases the risk of unintended invocation, especially because the skill can perform searches and live price lookups that may influence transactions or expose user intent to external services.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger examples include very broad, everyday shopping phrases such as gift-finding or casual product browsing, which can cause the skill to activate in contexts the user did not clearly intend. Over-broad activation can route unrelated conversations into a network-backed commerce workflow, increasing the chance of unintended data sharing, confusing tool use, or manipulation of user decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring and CLI usage text are presented only in Chinese, and the runtime error message is also Chinese-only. This imposes a specific language on users without offering an opt-in choice or documenting that the skill is intentionally region- or locale-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: When invoked incorrectly, the script returns an error message only in Chinese. This is a natural-language policy issue because it forces one language for user interaction without presenting alternatives or a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code contains Chinese-only user-facing/domain strings and a comment indicating a locale-specific output choice, while not providing any opt-in or alternate language behavior. The policy requires flagging language or locale constraints when a specific language is forced without user choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code constructs an HTTP request to a third-party Supabase endpoint using the user's keyword and executes it immediately. While network access is central to the script's purpose, there is no explicit notice in the code output or comments that the provided search term will be transmitted off-host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.