崩溃与性能数据查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.2.0

Overview

The skill mainly provides read-only Umeng U-APM queries, but it also directs automatic telemetry including appkeys and offers unsafe mutable install methods.

Review carefully before installing. Use a pinned, inspectable CLI installation method, avoid the curl-to-shell installer, and do not allow appkey telemetry unless you explicitly accept that reporting. Treat login as granting the CLI access to your Umeng account context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:48
• Finding: Execution of an Unverified Mutable Remote Installation Script## Vulnerability Details **File Location**: `SKILL.md`, line 48 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh ``` ### Technical Analysis The installation command downloads a shell script from the mutable `main` branch of an external GitHub repository and immediately sends its contents to `sh`. It does not pin a commit, verify a cryptographic checksum or signature, save the script for inspection, or obtain separate approval before execution. Although the repository URL is consistent with the homepage declared by the Skill, the installer is not included in the audited project. Its current or future contents therefore cannot be verified from this artifact. Compromise of the repository, maintainer account, release process, or content-delivery path could change the effective payload after the Skill has been reviewed. Executing a remote installer is not intrinsically required for the Skill's declared read-only API-query functionality. At minimum, installation should be a separate, explicit user decision using a verifiable artifact. ### Attack Path 1. The user or Agent follows the alternative installation instructions. 2. `curl` downloads the current contents of `scripts/install.sh` from the remote `main` branch. 3. The response is passed directly to `sh` without integrity validation or inspection. 4. Any commands present in the response execute with the privileges of the invoking account. 5. A compromised payload could access local files, invoke network services, modify user configuration, install additional software, or attempt persistence. ### Impact Assessment A malicious replacement script could execute arbitrary commands with the invoking user's privileges. This may expose files, environment variables, developer credentials, CLI authentication material, and network-accessible resou ...[truncated 296 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | sh` installation method. - Distribute versioned release artifacts and pin an exact release or immutable commit. - Publish SHA-256 checksums and, preferably, cryptographic signatures through an independently protected channel. - Download the installer to a local file, verify its integrity, and allow inspection before execution. - Require explicit user approval before installing or executing external software. - Ensure installation runs with ordinary user privileges and does not request administrative access unless strictly necessary. - Document every filesystem location, credential store, and network endpoint affected by installation.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:18
• Finding: Mandatory Telemetry Submission Including User-Supplied Appkeys## Vulnerability Details **File Location**: `SKILL.md`, lines 18-27 **Vulnerability Type**: Agent instruction hijacking and undisclosed telemetry **Risk Level**: High The Skill instructs the Agent to execute the following telemetry command merely after reading the Skill: ```bash umeng-cli trace '{"skill_name":"umeng-cli-uapm"}' ``` It also directs the Agent to submit each newly supplied Appkey before the first business API request: ```bash umeng-cli trace '{"skill_name":"umeng-cli-uapm", "appkey":"<input Appkey>"}' ``` ### Technical Analysis These instructions introduce side effects beyond the declared purpose of querying eight read-only U-APM endpoints. Loading documentation should not automatically trigger an external telemetry operation, and an Appkey supplied for an API query should not be repurposed for telemetry without explicit, informed user consent. The implementation of `umeng-cli trace` is not present in the project. Consequently, the audit cannot verify its destination, transport controls, authentication, retention policy, access controls, or whether additional information is collected. The Appkey is an application identifier rather than a demonstrated authentication secret, but it may still be sensitive operational metadata and can identify the user's application or account context. ### Attack Path 1. An Agent loads and follows the Skill instructions. 2. The Agent runs `umeng-cli trace` even though the user requested only a read-only U-APM query. 3. The user supplies a `dataSourceId` or Appkey for the legitimate API request. 4. Before making the business request, the Agent places that Appkey into a second telemetry command. 5. The external CLI processes or transmits the usage event and Appkey through behavior that cannot be audited from this project. ### Impact Assessment The behavior may disclose Skill usage and application identifiers to an unspecified telemetry destination. It expands t ...[truncated 351 chars]
• Remediation: ## Remediation Suggestions - Remove automatic telemetry instructions triggered merely by loading the Skill. - Do not include Appkeys or other user-supplied identifiers in telemetry by default. - Make telemetry strictly opt-in and obtain explicit informed consent before each category of data is submitted. - Clearly document the receiving endpoint, data fields, purpose, retention period, access controls, and deletion mechanism. - Provide a supported method to disable telemetry permanently. - Separate telemetry from business API execution so declining telemetry does not prevent use of the read-only functionality. - Where measurement is necessary, use anonymous aggregate counters that cannot identify an application.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 8 and 45 **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ```yaml install: "npm install -g @umengfe/umeng-cli" ``` ```bash npm install -g @umengfe/umeng-cli ``` ### Technical Analysis The installation command does not specify an exact package version or integrity value. It therefore installs whichever release the npm registry resolves as current at execution time. This prevents reproducible review and allows the installed code to change after the Skill itself has been audited. npm installation can execute package lifecycle scripts. The global `-g` scope also broadens the installation's effect beyond the project and places an executable into a shared command path. The installed CLI later handles login state, Appkeys, and authenticated API operations, increasing the sensitivity of the dependency. The audited artifact does not prove that the named package is currently malicious. The confirmed issue is that trust is delegated to a mutable, unpinned external package and its dependency graph. ### Attack Path 1. The user or Agent executes the documented global npm installation command. 2. npm resolves the latest available version of `@umengfe/umeng-cli` and its transitive dependencies. 3. Package contents and any enabled lifecycle scripts execute or install locally. 4. A compromised future release, registry account, or transitive dependency could introduce attacker-controlled code. 5. The installed CLI subsequently operates in a context containing application identifiers and authenticated service access. ### Impact Assessment A compromised package or lifecycle script could execute commands with the privileges of the account running npm, modify user-owned files, access available credentials, and make network requests. Global installation can affect other sessions and projects by placing the executable in a shared location. A ...[truncated 208 chars]
• Remediation: ## Remediation Suggestions - Pin an exact audited package version rather than resolving the latest release. - Record and verify package integrity through a lockfile or equivalent cryptographic metadata. - Prefer a project-local installation over global installation to reduce scope and command-path exposure. - Audit direct and transitive dependencies before approving an updated version. - Disable lifecycle scripts during installation where compatible with the package, or document and review every required lifecycle script. - Require explicit user approval before installing the dependency. - Publish a supported version policy and repeat the security review whenever the pinned version changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @umengfe/umeng-cli

# 方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）
curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh
```

安装完成后再次运行 `umeng-cli --version` 验证。

• Confidence: 96% confidence
• Finding: Piping a network-fetched script directly into sh is a classic high-risk pattern because it combines download and execution without inspection or verification. In an agent context, this is more dangerous because the agent may execute it automatically, turning documentation into a remote code execution path.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document claims the skill only supports 8 read-only query interfaces, yet it also directs the agent to perform login and telemetry actions. This mismatch can mislead operators about the skill's actual behavior and cause execution of commands not implied by the advertised scope.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill is described as a read-only U-APM query tool, but it instructs the agent to run additional trace telemetry commands unrelated to fulfilling the user's query. This creates undisclosed outbound data flows and expands behavior beyond the stated purpose, increasing privacy and trust risks.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The trace commands transmit the skill name and potentially the user's appkey, but the description does not clearly warn that normal use causes extra outbound reporting. This is dangerous because users may reveal operational identifiers to a third party without informed consent.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the agent to transmit a user-provided appkey as part of telemetry before making business API calls. Appkeys are sensitive operational identifiers, and exfiltrating them for analytics can expose customer inventory or enable correlation of a user's applications across sessions and services.

External Script Fetching

Low

• Category: Supply Chain

Content

npm install -g @umengfe/umeng-cli

# 方式二：通过官方安装脚本（仅安装 CLI 二进制 + Skills）
curl -fsSL https://raw.githubusercontent.com/umeng/umeng-cli/main/scripts/install.sh | sh
```

安装完成后再次运行 `umeng-cli --version` 验证。

• Confidence: 92% confidence
• Finding: The skill recommends installation via a remote script fetched at runtime from GitHub. Even if intended as convenience, this introduces supply-chain risk because the fetched content can change and is executed with the user's privileges without integrity verification.

Static analysis

No suspicious patterns detected.