Price Alert Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:39 AM UTC
• Version: 1.0.0

Overview

This skill is not malicious, but it advertises real price monitoring and notifications while its code only generates random prices and prints local messages.

Install only if you understand this is a prototype-style local script, not a reliable price monitor. It stores product URLs and target prices in your home directory, generates fake prices, and will not send real notifications unless the implementation is changed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior claims real price monitoring, trend/history support, and notification delivery, but the implementation reportedly uses simulated random prices and only prints alerts locally. This mismatch is dangerous because it can mislead users into trusting nonexistent monitoring or notifications, causing missed purchases, false assumptions about automation, and unsafe disclosure decisions based on inaccurate capability claims.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises commands that imply file reads/writes and network access, but it does not declare any explicit tool scope or permissions boundaries. This is dangerous because users and host systems cannot easily determine or constrain what external access the skill may require, increasing the risk of unintended data access or outbound requests.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: A nonspecific trigger around price trends may ambiguously match general requests for price analysis or shopping advice. This can cause the wrong skill to activate and process user input in ways unrelated to the user's intent, reducing trust and potentially exposing product data to unneeded processing.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: An overly broad trigger like shopping monitoring can activate on ordinary user requests that do not clearly ask for this skill. That is dangerous because it increases unintended invocation, which may lead to unnecessary URL handling, file writes, or external notifications in contexts where the user did not expect them.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill describes email and webhook notifications but does not warn that product URLs or related metadata may be transmitted to external services. This is dangerous because users may unknowingly send shopping data, identifiers, or internal links to third-party systems without informed consent.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file header and user-facing strings indicate the skill operates in Chinese, and there is no visible option for the user to select another language or locale. This can violate a language/locale policy when the skill imposes a specific language without documented opt-in or justification.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The function documented as obtaining product prices actually returns random simulated values, which makes all monitoring results false while presenting them as real. In a price-monitoring skill, this is dangerous because it undermines the integrity of the core function and can trigger false alerts or hide real price drops.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill metadata promises notifications when prices drop below a threshold, but the implementation only prints a local console message during a manual check and does not send any actual alert. This is a deceptive capability mismatch that can cause users to rely on the tool for time-sensitive purchasing decisions and miss important events.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The skill description, triggers, and usage guidance are entirely in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless clearly justified as region-specific.

Static analysis

No suspicious patterns detected.