Security audit

ZUOZUO PET Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed pet profile and shopping assistant, but it can present randomly generated product data as precise health-related shopping recommendations.

Review before installing. The local profile behavior is visible and mostly purpose-aligned, but you should be comfortable with plaintext storage of pet health and region data. Treat product recommendations as synthetic search suggestions, not verified product, price, ingredient, medical, or availability information.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: tools/save_pet_profile.py:12
Finding: Pet Health Profile Stored Without Explicit Access Controls
Content: View full analysis
Remediation: View remediation

other

Warning

Location: tools/search_pet_products.py:38
Finding: Randomly Fabricated Product Data Presented as Precise Shopping Recommendations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description emphasizes nutrition, medical-style guidance, and shopping help, but the workflow also includes local persistence of sensitive pet/profile and health-condition data that is not clearly disclosed as a primary behavior. This mismatch matters because users may share medical and location details under incomplete notice, creating privacy and consent risk even if the storage is only local.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description emphasizes nutrition, medical-style guidance, and shopping help, but the workflow also includes local persistence of sensitive pet/profile and health-condition data that is not clearly disclosed as a primary behavior. This mismatch matters because users may share medical and location details under incomplete notice, creating privacy and consent risk even if the storage is only local.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares access to local file read/write behavior and network-style product search without any explicit tool scoping, permissions, or allowed-tools declaration. In a skill that collects pet health/profile data and persists it locally, missing scope boundaries increases the risk of overbroad tool access, unintended data exposure, and unsafe expansion of capability beyond what users would reasonably expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "pet assistant" is generic and likely to appear in ordinary conversation, making accidental activation more likely. Because activation can lead to profile collection, local storage, and shopping/search workflows, an overly broad trigger increases the chance of unintended tool invocation and consent bypass in normal chat.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The onboarding flow instructs the assistant to collect species, breed, age, weight, health conditions, and region, then save them locally, but the skill description does not clearly warn users that this data will be collected and persisted. This creates a meaningful transparency and consent issue, especially because health-related details and regional data are sensitive in context and can influence later recommendations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to collect the user's country/region for shopping recommendations and to use a product-search tool, but it provides no notice about why that data is needed, how it will be used, or whether it will be shared with external services. In a pet-health assistant context, this profiling can be combined with health and purchasing preferences, creating unnecessary privacy risk and possible third-party data exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module documentation says the script outputs JSON by aggregating local knowledge bases and simulating network search results. However, the implementation constructs real Amazon URLs at L47 and returns them as purchase links at L54, which is a materially different behavior because it directs users to an external commercial site rather than keeping results purely simulated/local.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language and logic in this file force a specific regional behavior: users are bucketed into North America vs. everywhere else, with currency and platform selection automatically derived from that assumption. This is a locale policy concern because the skill does not offer user opt-in or a choice of language/locale behavior, and the simplification is not justified as a region-specific tool.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The argparse description states the tool returns items with affiliate links, and the top-level docstring similarly mentions product links with affiliate ID. In practice, the code builds only a standard Amazon search URL using the encoded query at L47 and never appends any affiliate/tag parameter, so the documentation contradicts the actual output.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.