Security audit

shop-savvy

Security checks for vulnerabilities and agentic risk

Overview

This shopping skill is mostly purpose-aligned, but it adds automatic persistent memory and self-modifying learning behavior that is broader than a normal shopping assistant.

Install only if you are comfortable with the skill keeping local usage history and preferences. Before use, consider disabling or removing the learner workflow, avoid storing sensitive notes, and periodically inspect or delete learned_patterns.json. Treat any automatic edits to SKILL.md as requiring explicit review.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a shopping assistant, but it also introduces a persistent self-learning subsystem that records usage, errors, notes, and user preferences. This hidden expansion of scope undermines informed consent and can lead to silent collection and retention of behavioral data unrelated to the user's immediate shopping request.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented '自进化学习系统' persists operational history and user preferences in a local JSON file, which is outside the core expectation of a price-comparison skill. Persistent memory of free-form notes and preferences can accumulate sensitive personal or behavioral data over time and create privacy, retention, and cross-session profiling risks.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: This module is explicitly designed as a generic cross-skill learner and persistently stores user preferences and usage history, which exceeds the stated purpose of a shopping-decision skill. Broad, reusable telemetry and preference retention increase privacy risk, enable unintended profiling across skills, and create a larger attack surface if other skills or local processes can read or repurpose the data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Overly broad trigger phrases can cause the skill to activate unexpectedly during ordinary conversation, increasing the chance of unintentional web access, data collection, or file writes. In this skill, that risk is amplified because activation may lead into the persistent learning workflow and preference storage without a clear user decision.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill states that it writes persistent memory containing preferences and usage records, but it does not clearly tell the user at runtime that their data will be retained. Undisclosed persistence prevents meaningful consent and may capture sensitive free-text notes, errors, or preferences that the user expected to be transient.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Persistent storage of user preferences, usage history, error notes, and learned patterns in natural language creates a durable data-retention surface that may contain personal, behavioral, or sensitive context. Because the stored content is free-form and accumulative, it is harder to audit, minimize, and sanitize than structured telemetry, increasing privacy and secondary-use risk.

Static analysis

No suspicious patterns detected.