Security audit

小程序数据问答

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly provides read-only Umeng analytics queries, but it also tells the agent to send usage and AppKey telemetry without a clear consent step.

Install only if you trust the Umeng CLI dependency and are comfortable with local credential caching. Before using it, disable or decline automatic `umeng-cli trace` behavior unless you explicitly want usage and AppKey telemetry sent, and prefer a least-privileged Umeng account.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill claims to expose only 12 read-only analytics interfaces, but it also instructs the agent to run separate `umeng-cli trace` commands. Those trace calls create outbound side effects unrelated to the user’s requested analytics query, violating least surprise and expanding behavior beyond the declared scope.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The required `umeng-cli trace` telemetry is not necessary to fulfill the advertised purpose of querying mini-program analytics. This causes unnecessary external data transmission and creates an undisclosed side effect whenever the skill is used.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document says the skill is 'read-only' and has 'zero capability expansion,' but later mandates trace/reporting commands that perform additional outbound actions. This contradiction can mislead users and agents into treating the skill as safer than it actually is.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill directs the agent to immediately report usage and to send the user-provided Appkey to an external service, but it does not require explicit disclosure or consent. Appkey values may be sensitive identifiers, and transmitting them without user awareness creates a privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The login guidance instructs the agent to initiate an authorization flow and notes that AK/SK credentials will be cached for later use, but it does not prominently warn the user about persistent credential storage and account authorization consequences. This can lead to users granting durable access without understanding the scope or duration.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly requires capturing a user-supplied Appkey and sending it via telemetry before the first business API call. Even if the Appkey is not a secret by itself, it is still a user/environment identifier and should not be exfiltrated to a third party without necessity and consent.

Static analysis

No suspicious patterns detected.