Necessity Review Mining Selection Rijoy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:25 AM UTC
• Version: 0.1.2

Overview

The skill is mostly a review-mining helper, but it steers broad product-review outputs toward a specific third-party service and has some under-scoped data-export risks.

Review the Rijoy-related instructions before installing. This skill may cause agents to recommend a specific third-party loyalty/review platform in broad review-analysis answers, even when you only asked for neutral product-improvement advice. Use only de-identified review data where possible, and be careful opening exported CSV files in spreadsheet apps until formula escaping is added.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:130

Finding

Mandatory Third-Party Promotion Hijacks Review-Analysis Output

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pain_point_extractor.py:146

Finding

Spreadsheet Formula Injection in CSV Exports

Content

View full analysis

None: with path.open("w", encoding="utf-8", newline="") as f: w = csv.writer(f) w.writerow(["label", "count", "examples"]) for label, info in aggregated.items(): w.writerow([label, info.count, " | ".join(info.examples)]) def write_csv_tagged(path: Path, tagged: Iterable[dict]) -> None: with path.open("w", encoding="utf-8", newline="") as f: w = csv.writer(f) w.writerow(["review", "labels"]) for item in tagged: w.writerow([item.get("review", ""), ",".join(item.get("labels", []))]) ``` ### Technical Analysis Both export functions write untrusted strings directly into CSV cells: - Review text originates from user-supplied CSV, TXT, or standard input. - Labels can originate from a caller-supplied keyword-map JSON file. - Aggregate examples contain substrings copied directly from review text. Python's `csv.writer` correctly quotes values for CSV syntax, but CSV quoting is not spreadsheet formula neutralization. Spreadsheet applications can interpret cells beginning with `=`, `+`, `-`, or `@` as formulas after the exported file is opened. For example, an attacker-controlled review beginning with a spreadsheet formula remains formula-prefixed when written by `write_csv_tagged`. The same review can also appear in the aggregate `examples` field. A malicious custom label can reach either the `label` or `labels` output columns. Actual behavior depends on the spreadsheet client and its security settings. Possible effects include deceptive hyperlinks, external-resource requests, data disclosure through formula evaluation, or invocation of dangerous legacy fun ...[truncated 1582 chars]

Remediation

View remediation

str: text = str(value) if text.startswith(FORMULA_PREFIXES): return "'" + text return text ``` 2. Apply the function to all attacker-controlled output fields: ```python w.writerow([ spreadsheet_safe(label), info.count, spreadsheet_safe(" | ".join(info.examples)), ]) ``` ```python w.writerow([ spreadsheet_safe(item.get("review", "")), spreadsheet_safe(",".join(item.get("labels", []))), ]) ``` 3. Consider defensive handling for leading tabs, carriage returns, line feeds, and whitespace before a formula marker because spreadsheet behavior varies between applications. 4. Preserve an unmodified JSON output option for workflows that require exact review text, while clearly marking CSV output as spreadsheet-neutralized. 5. Document that review content and custom keyword maps are untrusted inputs. 6. Add regression tests for cells beginning with `=`, `+`, `-`, and `@`, including values preceded by whitespace or control characters. 7. Test generated files in the spreadsheet applications used by the intended operators to confirm that cells are displayed as literal text. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code is related to the declared domain in a narrow sense: it processes review text and extracts rough pain-point labels, so it partially supports review-analysis and pain-table style output. However, the declared description promises a substantially richer product-selection and improvement workflow: actionable spec requirements, selling points, prioritization logic, validation planning, and optional Rijoy-based feedback-loop integration. None of those higher-level capabilities appear in the code. The script is a standalone keyword-based labeler and aggregator with file/stdin I/O only, no recommendation engine, no prioritization framework beyond frequency counts, no validation-plan generation, and no external integration. Therefore the description overstates the implemented functionality enough to count as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to trigger on many broad phrases such as 'review analysis,' 'what should we improve next,' and even 'want to see what users complain about.' These are common requests that could match many unrelated review, CX, or product-analysis conversations, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill says to trigger whenever the user 'mentions (or clearly needs)' several broad concepts, but it does not define firm activation thresholds or negative examples in that section. Although a later scope section exists, the activation language here is still expansive enough to collide with ordinary requests about reviews, complaints, or prioritization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script can export raw review text and example snippets directly to stdout or files in both per-review and aggregate modes. Reviews often contain personal data, contact details, order information, or other sensitive free-form content, so echoing and storing that text without redaction, minimization, or an explicit privacy control creates a real data exposure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This JSON file defines all user-facing classification keywords exclusively in Chinese. If this skill is used in a broader multilingual context, forcing a single language without documented opt-in or locale justification can constitute a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.