polyv-e-commerce-setup

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:43 PM UTC
• Version: 1.0.2

Overview

The skill has a clear PolyV setup purpose, but it asks users to run mutable remote npm code while passing a sensitive AppSecret in plaintext command arguments.

Review before installing. Use a pinned, reviewed version of the PolyV CLI, avoid pasting AppSecret into chat, prefer a secure local credential prompt or secret manager, and rotate the AppSecret if it has already appeared in transcripts, shell history, or logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13
• Finding: Execution of an Unpinned Mutable npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13, 29-30, and 36 **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: High ### Vulnerable Code ```bash npx polyv-live-cli@latest account list ``` ```bash npx polyv-live-cli@latest account add --name <name> --app-id <appId> --app-secret <appSecret> npx polyv-live-cli@latest account set-default <name> ``` ```bash npx polyv-live-cli@latest setup e-commerce ``` ### Technical Analysis The Skill instructs users or agents to execute `polyv-live-cli@latest` directly through `npx`. When the package is not already present locally, `npx` can retrieve it from an external package registry and immediately execute its code. The `latest` tag is mutable and does not identify the specific package release that was reviewed. Consequently, the code executed during a future invocation may differ from the code available at audit time. The Skill also provides no package integrity hash, lockfile, provenance verification, or trusted-version constraint. This creates a dependency supply-chain risk. Compromise of the package publisher account, package registry, publication process, or a future package release could cause arbitrary code to run under the invoking user's privileges. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, package registry entry, or another mechanism controlling the `latest` package release. 2. The attacker publishes a malicious version of `polyv-live-cli` and causes the `latest` tag to reference it. 3. A user or agent follows the Skill and invokes one of the documented `npx polyv-live-cli@latest` commands. 4. `npx` downloads and executes the attacker-controlled package. 5. The malicious package inherits the permissions and environment of the invoking process. 6. During account setup, the package may also receive the PolyV AppID and AppSecret supplied to the command, allowing those credentials to be captured. ### Impact As ...[truncated 892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version, for example: ```bash npx --yes polyv-live-cli@<reviewed-exact-version> account list ``` 2. Record the dependency in a package manifest and lockfile rather than resolving a mutable release at each invocation. 3. Verify package integrity using the package manager's integrity metadata and a trusted lockfile. 4. Review the selected package version, publisher identity, repository, release provenance, and install scripts before approving execution. 5. Configure trusted registry sources explicitly and prevent fallback to unexpected registries. 6. Use automated dependency monitoring, but require review before updating the pinned version. 7. Where practical, execute the CLI in a restricted environment with minimum filesystem, credential, and network access. 8. Document the expected version and cryptographic digest so users can detect unexpected package changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: PolyV AppSecret Exposed Through Conversation and Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-29 **Vulnerability Type**: Insecure plaintext secret handling **Risk Level**: Medium ### Vulnerable Code ```text 如果用户未配置认证，引导用户提供 AppID 和 AppSecret： 请提供你的 PolyV AppID 和 AppSecret： - 访问 https://console.polyv.net/ 后台获取 - 路径：云直播 -> 设置 -> 开发者信息 ``` ```bash npx polyv-live-cli@latest account add --name <name> --app-id <appId> --app-secret <appSecret> ``` ### Technical Analysis The Skill tells the agent to ask the user for an AppSecret and then insert that secret directly into the `--app-secret` command-line argument. Supplying the secret through an agent conversation may place it in plaintext transcripts, model inputs, audit records, execution traces, or platform telemetry. Supplying it as a command-line argument can additionally expose it through shell history, process inspection facilities, command logging, error reports, or automation logs. The exact exposure depends on the chat platform, shell, operating system, and CLI implementation. Nevertheless, the documented workflow unnecessarily places a long-lived credential in multiple observable channels instead of using a protected secret-input mechanism. ### Attack Path 1. A user follows the Skill and submits a valid PolyV AppID and AppSecret in the agent conversation. 2. The plaintext credential may be retained in conversation history, platform logs, telemetry, or execution records. 3. The agent constructs the documented command with the AppSecret in the process argument list. 4. The argument may become visible through shell history, process monitoring, command auditing, debug output, or logs. 5. An attacker or unauthorized operator with access to one of these records obtains the credential. 6. The attacker uses the credential against PolyV APIs or tooling, subject to the permissions assigned to that PolyV application. ### Impact Assessment Exposure of the AppSecret could allow unauthorized authentication to PolyV services when com ...[truncated 697 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to submit AppSecrets in an agent conversation. 2. Direct users to configure the credential through a trusted local terminal using hidden input. 3. Prefer a CLI option that reads the secret interactively without echoing it. If supported, use a protected standard-input or file-descriptor mechanism instead of a command-line argument. 4. Store the credential in the operating system's secure credential store or another approved secret manager with restrictive access controls. 5. Ensure the CLI configuration file, if one is required, has minimum filesystem permissions and never stores secrets in plaintext unless explicitly unavoidable and documented. 6. Disable shell command echoing and redact secrets from application logs, exception messages, telemetry, and audit output. 7. Avoid ordinary environment variables for long-lived credentials where other local processes or diagnostic tooling may expose them. 8. Document credential rotation and revocation procedures. Instruct users who have already pasted an AppSecret into chat or logs to rotate it. 9. Scope the PolyV application credential to the minimum permissions required for e-commerce setup. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill invokes `npx polyv-live-cli@latest`, which fetches and executes the latest package version at runtime rather than a reviewed, fixed version. This creates a supply-chain execution risk: if the package is compromised or a breaking/malicious update is published, users may run untrusted code with access to local credentials and environment data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly asks the user to provide AppID and AppSecret and then uses them in command-line arguments, without any warning about sensitive credential handling. This is dangerous because secrets may be exposed in chat logs, shell history, process listings, telemetry, or copied transcripts, increasing the chance of credential leakage and account compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Using `npx polyv-live-cli@latest` for account configuration causes the system to download and execute whatever version is current at the time of use. Because this command handles AppID/AppSecret material, a compromised or malicious package version could exfiltrate credentials or alter account settings.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This command also relies on `npx polyv-live-cli@latest`, introducing the same unpinned remote code execution risk. In the context of setting a default account, a malicious update could silently tamper with account selection, persist malicious config, or harvest locally stored tokens.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: Running `setup e-commerce` via `npx ...@latest` executes newly fetched code that can create or modify remote resources and local configuration. In a provisioning workflow, this is especially risky because compromised package code could perform unauthorized actions beyond the intended setup steps.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The file presents the skill description and operating instructions entirely in Chinese and does not offer any language choice or note that the skill is intended only for a Chinese-language audience. The policy specifically flags language or locale constraints when they are imposed without user opt-in or documented justification.

Static analysis

No suspicious patterns detected.