Security audit

App基础指标+智能巡检(异动报告)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a UMeng analytics helper, but it bundles and exports UMeng account-changing APIs that are broader than the read-only statistics use case users are likely to expect.

Install only if you are comfortable giving the agent access to a broad UMeng SDK, not just read-only metrics. Use tightly scoped UMeng credentials if possible, keep umeng-config.json private, and avoid invoking create/edit/back-report request classes unless you intentionally want account changes.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (37)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code automatically searches multiple local paths and environment variables for UMeng credentials, including the current working directory and the user's home directory. In an agent/skill context, this broad secret-loading behavior can cause unintended credential use or secret exfiltration risk if an attacker can influence the working directory or place a crafted config file where the skill will trust it.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The request class exposes payment/order analysis functionality while the skill manifest describes only basic UMeng app statistics such as new users and active users. This scope mismatch can cause the agent to access or disclose more sensitive business data than users or integrators expect, creating an authorization and least-privilege problem even if the code itself is simple.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This request class exposes a state-changing UMeng API operation (`umeng.uapp.createApp`) that creates a new app data source, while the skill metadata describes only read-only analytics/query behavior such as fetching metrics by APPKEY. That scope mismatch is dangerous because an agent or caller expecting harmless analytics access could instead be given write capabilities to create resources in the UMeng account, enabling unauthorized changes or abuse if the skill is invoked or repurposed.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill metadata says it is for querying UMeng analytics data, but this class performs a state-changing operation to create custom events. That mismatch is dangerous because an agent or user expecting read-only access could be induced to modify telemetry configuration or fabricate analytics-related objects without informed consent.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The docstring explicitly states that this request creates a custom event, which contradicts the manifest's read-only analytics description. In security-sensitive agent environments, this inconsistency increases the risk of privilege misuse because harmful write actions can be hidden behind benign-seeming skill descriptions.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file defines a write-capable API request that batch creates UMeng mini-program events, while the skill metadata describes a read-only analytics/query capability. This mismatch expands the effective permission and action surface of the skill, creating a capability-confusion risk: an agent or integrator expecting only data retrieval could invoke state-changing operations against the UMeng account.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This class exposes a state-changing UMeng API to create a mini-app data source, while the skill metadata describes a read-only analytics/query capability. That scope mismatch is dangerous because an agent or downstream caller could invoke unintended provisioning actions using authenticated credentials, expanding from passive data access into resource creation and secret handling.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The request object includes provisioning-related fields such as miniAppSecret, miniPublicKey, and miniPrivateKey, which are unrelated to the stated purpose of querying app statistics. In the context of an analytics skill, bundling creation and credential-material parameters increases the risk of unauthorized app onboarding, misuse of privileged auth, and accidental exposure or mishandling of sensitive secrets.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata describes a read-only UMeng analytics capability, but this class exposes a state-changing API that edits mini-app data sources and associated configuration. This mismatch is dangerous because an agent or user expecting safe statistics queries could be induced to perform unauthorized administrative changes, violating least privilege and enabling covert modification of application settings.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This request object includes fields for sensitive mini-app credentials and key material such as miniAppSecret, miniPublicKey, and miniPrivateKey, which are unrelated to the stated analytics-query purpose. In the context of a supposedly read-only statistics skill, exposing credential-management inputs increases the risk of secret handling, unauthorized reconfiguration, accidental leakage through logs, and abuse of the agent to alter authentication material.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The file exposes an edit/write API (`umeng.umini.editPathDisplayName`) that changes page path display names, but the skill metadata describes a read-only statistics/query capability. This mismatch expands the skill's effective privileges beyond user expectations and can enable unauthorized or unintended modification of UMeng application configuration if the agent invokes this endpoint.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill manifest describes a read-only analytics/query capability, but this module exports mutating operations such as app creation and event creation. That expands the effective capability of the skill beyond user expectations and least-privilege boundaries, creating a confused-deputy risk where an agent or user could trigger state-changing actions unintentionally.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module exposes mini-app management/edit operations even though the declared purpose is statistics querying. In an agent setting, hidden mutating capabilities are dangerous because they can be invoked through tooling despite the natural-language description implying read-only access.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: Exporting mini-app creation functionality exceeds the stated analytics-only scope and introduces an undeclared write/admin capability. This mismatch is especially risky in agent ecosystems because trust decisions are often based on the manifest, not the full code surface.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: This class exposes a write/back-reporting API (`umeng.apptrack.backReportData`) even though the skill is described as a read-only analytics lookup tool for querying UMeng statistics by APPKEY. That capability mismatch is dangerous because an agent or downstream caller could be induced to send reporting data to an external service, creating unauthorized state changes or data exfiltration paths that are outside the user-expected scope.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The presence of a back-reporting method is not justified by the stated skill purpose of analytics retrieval, which increases the chance of confused-deputy behavior: the agent may possess credentials for an operation the user did not request or expect. In context, this makes the skill more dangerous because it expands from passive data access into authenticated data submission, which can be abused to push falsified or sensitive reporting payloads.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The implemented request class accesses order-analysis data by planId/unitId and queryDate, which is materially different from the skill's declared purpose of querying UMeng app basic statistics such as new users and active users via APPKEY. This capability mismatch can cause the agent to invoke an unintended API surface and expose or retrieve business/order analytics outside the user's expected scope, creating a permission and data-governance risk.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file defines a request class for `umeng.uapp.createApp`, which performs creation of a new UMeng app/data source rather than read-only analytics queries described in the skill metadata. In a skill advertised as querying APPKEY statistics, exposing a state-changing create operation expands privileges and can enable unauthorized resource creation, API misuse, billing/admin impact, or a deceptive capability mismatch that users and reviewers would not expect.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The docstring explicitly states 'U-App新建数据源' and references the create-app API, confirming behavior that contradicts the manifest's query-only description. This inconsistency is dangerous because it obscures a write-capable administrative action inside a seemingly analytics-only skill, increasing the risk of accidental or unauthorized execution and weakening review transparency.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill metadata says it is for querying UMeng analytics data such as new users and active users, but this class calls the event-creation endpoint `umeng.uapp.event.create`, which changes remote state rather than reading statistics. In an agent setting, this capability mismatch is dangerous because a user expecting read-only analytics access could instead trigger unauthorized creation of tracking events, violating least privilege and enabling hidden data-manipulation actions.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Including event-definition creation in a skill described as analytics querying expands the tool's authority beyond what users and integrators would reasonably expect. This mismatch increases the risk of confused-deputy behavior, where prompts about APPKEY or statistics could be routed to a write operation that alters telemetry definitions, causing integrity issues in analytics data and potentially creating persistent unauthorized events.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The skill metadata describes a read-only UMeng statistics query capability, but this class exposes a write operation that batch-creates events. That mismatch increases the risk that a user or orchestrator invoking the skill for analytics could unknowingly trigger state-changing actions in an external system, violating least privilege and enabling unauthorized data injection or manipulation.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This class exposes a write/provisioning API (`umeng.umini.createMiniApp`) even though the skill metadata describes a read-only analytics/query capability. In an agent context, this creates unnecessary authority expansion: a user or downstream prompt flow intended to fetch statistics could instead trigger creation of new UMeng mini-app data sources and submit sensitive identifiers/keys.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The defined fields support administrative onboarding of a mini-app, including IDs, secrets, and integration parameters, which is not justified by the stated purpose of querying UMeng metrics like new users or active users. In a skill ecosystem, such hidden provisioning capability is dangerous because it broadens the attack surface and may enable unauthorized resource creation or account manipulation under the agent's credentials.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This class exposes an API operation that edits mini-app data source configuration, including sensitive fields such as miniAppSecret, miniPublicKey, and miniPrivateKey, while the skill metadata describes a read-only analytics/query capability. That mismatch expands the skill's effective privilege from data retrieval to configuration change, creating a confused-deputy risk where a user or downstream component could modify UMeng app integrations or secrets through a skill that should only query statistics.

Static analysis

No suspicious patterns detected.