my-halala-sales-vp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:48 AM UTC
• Version: 1.1.1

Overview

This private workflow is not clearly malicious, but it needs Review because it handles login tokens and can send collected procurement, contact, and attachment data to a configurable external AI endpoint.

Install only on the owner’s controlled machine. Keep the workdir private, protect or rotate QIANLIMA_TOKEN, and avoid --analyze-details unless you are comfortable sending tender details, contacts, and extracted attachment text to the configured model provider. If using analysis, set a trusted HTTPS endpoint and token, and review dependency locking before broader use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qianlima_client.py:648

Finding

Configurable Model Endpoint Can Receive Sensitive Procurement and Contact Data

Content

View full analysis

str: if not config.analysis_token: raise QianlimaError("缺少环境变量 ANTHROPIC_AUTH_TOKEN") prompt = """你是医疗招投标信息分析助手。只能依据输入数据，不要猜测。 请用中文 Markdown 输出： 1. 招标项目一句话结论 2. 招标需要什么：产品、服务、供应商资质、报名/投标要求、关键日期 3. 重点与难点：逐条说明，并给出依据 4. 单位信息：招标单位、代理单位及其他单位 5. 产品清单：逐项列出；若原文没有完整清单，明确说明缺失 6. 联系人信息：姓名、角色、电话、邮箱；对脱敏或缺失字段明确标注 7. 信息完整性审计：单位、产品、联系人、金额、截止时间、附件是否齐全 8. 建议下一步动作 输入数据： """ + json.dumps(cleaned, ensure_ascii=False) url = config.analysis_base_url.rstrip("/") + "/v1/messages" response = requests.post( url, headers={ "Authorization": f"Bearer {config.analysis_token}", "Content-Type": "application/json", }, json={ "model": config.analysis_model, "max_tokens": 128000, "messages": [{"role": "user", "content": prompt}], }, timeout=180, ) response.raise_for_status() ``` ```python analysis_base_url=os.environ.get( "ANTHROPIC_BASE_URL", "https://api.minimaxi.com/anthropic" ), analysis_token=os.environ.get("ANTHROPIC_AUTH_TOKEN", "").strip(), ``` ### Technical Analysis The optional analysis feature serializes the complete `cleaned` detail object into a model prompt. That object can contain procurement text, contact information, source metadata, and text extracted from downloaded attachments. The destination is derived directly from the environment-controlled `ANTHROPIC_BASE_URL`. The implementation does not require HTTPS, restrict the hostname to approved model providers, or obtain explicit confirmation before transmitting contacts and attachment contents. The model API token is also placed in the `Authorization` header ...[truncated 1418 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/bootstrap_workdir.sh:11

Finding

Bootstrap Installs Unhashed and Incompletely Pinned Dependencies

Content

View full analysis

=0.11,<1 python-dotenv==1.1.1 ``` ### Technical Analysis The bootstrap script upgrades pip dynamically and installs packages from the active pip configuration. `curl-cffi` is constrained only to a broad version range, while neither dependency has an artifact hash. Consequently, two installations performed at different times can resolve to different package or pip versions. The effective installation source can also be changed through pip configuration or environment variables. Because Python packages and installation tooling execute code with the invoking user's privileges, compromise of a permitted future release, package index, or host pip configuration could introduce unreviewed code. No malicious dependency was identified in the supplied project. This is a supply-chain hardening weakness rather than evidence that the currently named packages are malicious. ### Attack Path 1. An attacker compromises an allowed future `curl-cffi` release, influences the configured package index, or modifies the host's pip configuration. 2. The owner runs `scripts/bootstrap_workdir.sh` on a host where the virtual environment does not already exist. 3. The script downloads an unreviewed pip version and dependency artifacts without verifying expected hashes. 4. Malicious package installation or runtime code executes under the account running the bootstrap script. The attack depends on compromise or manipulation outside the audited repository. ### Impact Assessment A malicious dependency or installation artifact woul ...[truncated 453 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a private test workflow, but it performs remote authentication, QR-based login, cookie/token extraction, and secret persistence to a local env file. Undisclosed auth-handling behavior is security-relevant because it processes session credentials and can normalize risky secret storage patterns under a seemingly limited description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is described as a private test workflow, but it performs remote authentication, QR-based login, cookie/token extraction, and secret persistence to a local env file. Undisclosed auth-handling behavior is security-relevant because it processes session credentials and can normalize risky secret storage patterns under a seemingly limited description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill explicitly instructs storing credentials in a local .env file, which is plaintext secret storage even if permissions are set to 600. Local env files are commonly exposed through backups, accidental reads, logs, shell history, or other tooling, and this skill already centers on token-based authentication.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash

bash "$SCRIPTS/bootstrap_workdir.sh"
# Creates $QIANLIMA_WORKDIR (default ~/.my-halala-sales-vp), venv, data/output/runtime
# Place credentials only in $QIANLIMA_WORKDIR/.env mode 600 (never into the skill folder)

Quick Reference

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bootstrap_workdir.sh (reported line 19)May include surrounding context.

sh

echo "QIANLIMA_WORKDIR=$WORKDIR"
echo "python=$WORKDIR/.venv/bin/python"
echo "Create $WORKDIR/.env (mode 600) with QIANLIMA_TOKEN and QIANLIMA_OPENID, or export them on the host."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 40)May include surrounding context.

python

echo "QIANLIMA_WORKDIR=$WORKDIR"
echo "python=$WORKDIR/.venv/bin/python"
echo "Create $WORKDIR/.env (mode 600) with QIANLIMA_TOKEN and QIANLIMA_OPENID, or export them on the host."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_qr_login.py (reported line 170)May include surrounding context.

python

echo "QIANLIMA_WORKDIR=$WORKDIR"
echo "python=$WORKDIR/.venv/bin/python"
echo "Create $WORKDIR/.env (mode 600) with QIANLIMA_TOKEN and QIANLIMA_OPENID, or export them on the host."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 47)May include surrounding context.

python

candidates.append(Path(env_file).expanduser())
    workdir = os.environ.get("QIANLIMA_WORKDIR", "").strip()
    if workdir:
        candidates.append(Path(workdir).expanduser() / ".env")
    candidates.append(Path.cwd() / ".env")
    candidates.append(Path(__file__).resolve().with_name(".env"))
    for path in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 48)May include surrounding context.

python

candidates.append(Path(env_file).expanduser())
    workdir = os.environ.get("QIANLIMA_WORKDIR", "").strip()
    if workdir:
        candidates.append(Path(workdir).expanduser() / ".env")
    candidates.append(Path.cwd() / ".env")
    candidates.append(Path(__file__).resolve().with_name(".env"))
    for path in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 49)May include surrounding context.

python

candidates.append(Path(env_file).expanduser())
    workdir = os.environ.get("QIANLIMA_WORKDIR", "").strip()
    if workdir:
        candidates.append(Path(workdir).expanduser() / ".env")
    candidates.append(Path.cwd() / ".env")
    candidates.append(Path(__file__).resolve().with_name(".env"))
    for path in candidates:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/qianlima_qr_login.py (reported line 166)May include surrounding context.

python

candidates.append(Path(env_file).expanduser())
    workdir = os.environ.get("QIANLIMA_WORKDIR", "").strip()
    if workdir:
        candidates.append(Path(workdir).expanduser() / ".env")
    candidates.append(Path.cwd() / ".env")
    candidates.append(Path(__file__).resolve().with_name(".env"))
    for path in candidates:

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script extracts an authenticated Admin-Token from the session and persists it, along with the OpenID, into a local .env file. Storing live third-party authentication material in a plaintext environment file increases the chance of credential disclosure through backups, logs, repo mistakes, broad filesystem access, or later consumption by unrelated processes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares no explicit tool scope or permission boundaries despite instructing use of shell commands, environment variables, local file access, and authenticated network operations. In a private skill that handles tokens and writes artifacts, missing tool restrictions increases the chance of unintended execution paths or overbroad agent authority.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Including a broad trigger term like 'halala' can cause accidental activation outside a clearly authenticated owner-only context. For a skill that performs authenticated network collection and handles credentials, unintended invocation raises the risk of unnecessary secret use or confusing cross-task execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction says to reply with a short Chinese summary for the owner only, which imposes a fixed language requirement. This is a language policy concern because the file does not indicate user opt-in or provide an option to use another language.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.1.1 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 96% confidence

Finding

python-dotenv is pinned to version 1.1.1, which the scanner flags as affected by a symlink-following/arbitrary file overwrite vulnerability in set_key. If this skill or supporting tooling ever modifies .env files on disk, an attacker who can influence the target path or place a symlink could overwrite unintended files, which is dangerous in a private workflow skill that may run with access to local secrets or deployment files.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap_workdir.sh (reported line 9)May include surrounding context.

sh

WORKDIR="${QIANLIMA_WORKDIR:-$HOME/.my-halala-sales-vp}"

mkdir -p "$WORKDIR"/{data,output,runtime}
chmod 700 "$WORKDIR" 2>/dev/null || true

if [[ ! -x "$WORKDIR/.venv/bin/python" ]]; then
  python3 -m venv "$WORKDIR/.venv"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The attachment text-extraction feature executes local document-conversion tools on downloaded files, introducing additional local processing capability beyond simple collection. Even without shell injection, processing untrusted office documents increases host attack surface and may surprise users of a narrowly scoped private skill.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 535)May include surrounding context.

python

else:
        return "", "当前系统缺少可用的 Word 文本提取器"
    try:
        completed = subprocess.run(
            command,
            check=True,
            capture_output=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script materially exceeds its stated purpose by downloading attachments, extracting document text, and optionally sending full procurement details to an external AI service. In a private sales/procurement workflow, this broadens data handling in ways users may not expect and can expose sensitive tender content, attachments, and contact information outside the original collection scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code includes a generic AI-analysis feature that sends collected detail data to a configurable third-party endpoint, which is broader than the narrowly described private workflow. This mismatch increases the chance of unauthorized or unintended reuse of collected sensitive business information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Sensitive procurement details, potentially including contacts, tender content, and extracted attachment text, are sent to an external analysis API without a user-facing warning at the call site. In this private skill context, that undisclosed third-party transfer creates confidentiality, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The requests.post call transmits the full cleaned detail payload to an external service, including potentially sensitive procurement content, contacts, and attachment-derived text. Because this is a private workflow tool and the transfer is not strongly bounded or disclosed at the execution point, the exfiltration risk is significant.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 675)May include surrounding context.

python

输入数据：
""" + json.dumps(cleaned, ensure_ascii=False)
    url = config.analysis_base_url.rstrip("/") + "/v1/messages"
    response = requests.post(
        url,
        headers={
            "Authorization": f"Bearer {config.analysis_token}",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 754)May include surrounding context.

python

token = token_file.read_text(encoding="utf-8").strip()
        if token_file.stat().st_mode & (stat.S_IRWXG | stat.S_IRWXO):
            print(
                f"[警告] {token_file} 权限过宽，建议执行 chmod 600",
                file=sys.stderr,
            )
    if token.lower().startswith("bearer "):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The default external endpoint points to a third-party AI provider, making outbound transmission easy to enable without additional scrutiny. In a private procurement/sales context, a baked-in default external service increases the likelihood of accidental disclosure of sensitive business data.

Content

Scanner excerpt · scripts/qianlima_client.py (reported line 782)May include surrounding context.

python

analyze_details=args.analyze_details,
        analysis_model=args.analysis_model,
        analysis_base_url=os.environ.get(
            "ANTHROPIC_BASE_URL", "https://api.minimaxi.com/anthropic"
        ),
        analysis_token=os.environ.get("ANTHROPIC_AUTH_TOKEN", "").strip(),
        refresh_details=args.refresh_details,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a private 'halala sales-vp experiments' skill intended only for explicit halala sales workflow use, but this script implements a standalone third-party authentication flow against qiye.qianlima.com and weixin.qq.com, then writes durable credentials into a .env file. That is a materially broader operational behavior than the manifest text suggests, because it provisions and stores access for an external service rather than merely supporting an obvious in-scope sales workflow action.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.