AIDSO-geo-product-diagnosis

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:31 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese-language AIDSO product-diagnosis/reporting workflow with guarded optional paid sampling and no artifact-backed evidence of deception, persistence, credential theft, or automatic network submission.

Install this only if you intend to use AIDSO/WorkBuddy-style Chinese GEO product diagnosis. For existing data, it should work offline on files you provide. For new sampling, review the full confirmation card, current point pricing, prompts, platform combinations, and repeat count before replying with the exact paid-authorization phrase; do not provide tokens in chat or reports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This second mismatch finding is also valid because the skill embeds a workflow for generating and validating paid sampling plans, enforcing exact authorization phrases, constraining task registry writes, and handling execution records—capabilities materially beyond simple report generation. Such hidden operational logic increases the risk of unintended paid actions or privileged workflow manipulation under a misleadingly narrow description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This second mismatch finding is also valid because the skill embeds a workflow for generating and validating paid sampling plans, enforcing exact authorization phrases, constraining task registry writes, and handling execution records—capabilities materially beyond simple report generation. Such hidden operational logic increases the risk of unintended paid actions or privileged workflow manipulation under a misleadingly narrow description.

MCP Config Access

High

• Category: Agent Snooping

Content

## 新采样、积分确认与任务恢复

MCP 由专家包根目录 `.mcp.json` 声明，凭据在 WorkBuddy 连接器设置中输入；不在聊天中索要或回显 Token。独立 Skill 包不包含专家根目录的连接器配置；在线采样需宿主已有可用的爱搜 MCP，已有数据的离线处理无需连接器。

1. 先运行 `python3 scripts/task_plan.py list-platforms`。只允许清单中的五种商品卡组合，并向用户展示平台、终端、模式、单次积分、价格来源和核对日期。内置价格快照来自用户提供的爱搜 API 文档（2026-08-25）：豆包手机快速 0.8、元宝网页快速 0.8、元宝手机快速 1、千问手机快速 1、千问手机深度 1；一题完整跑五种组合共 4.6 积分。提交前以爱搜实时价格页为准；价格变化时用带来源与核对时间的 `quote.json` 覆盖快照。
2. 核对工具 schema：MCP 使用 `thinkingEnabled`；HTTP 使用 `thinking_enabled`，不得混传。用 `task_plan.py plan` 展开逐题、逐组合、逐次独立采样的原子计划。`repeats` 是重复采样数，不是上下文多轮对话；任务台账只能保存在当前工作区 `.aidso-geo/tasks/`，已有台账不得覆盖。

• Confidence: 90% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

MCP Config Access

High

• Category: Agent Snooping

Content

## 新采样、积分确认与任务恢复

MCP 由专家包根目录 `.mcp.json` 声明,凭据在 WorkBuddy 连接器设置中输入;不在聊天中索要或回显 Token。独立 Skill 包不包含专家根目录的连接器配置;在线采样需宿主已有可用的爱搜 MCP,已有数据的离线处理无需连接器。

1. 先运行 `python3 scripts/task_plan.py list-platforms`。只允许清单中的五种商品卡组合,并向用户展示平台、终端、模式、单次积分、价格来源和核对日期。内置价格快照来自用户提供的爱搜 API 文档(2026-08-25):豆包手机快速 0.8、元宝网页快速 0.8、元宝手机快速 1、千问手机快速 1、千问手机深度 1;一题完整跑五种组合共 4.6 积分。提交前以爱搜实时价格页为准;价格变化时用带来源与核对时间的 `quote.json` 覆盖快照。
2. 核对工具 schema:MCP 使用 `thinkingEnabled`;HTTP 使用 `thinking_enabled`,不得混传。用 `task_plan.py plan` 展开逐题、逐组合、逐次独立采样的原子计划。`repeats` 是重复采样数,不是上下文多轮对话;任务台账只能保存在当前工作区 `.aidso-geo/tasks/`,已有台账不得覆盖。

• Confidence: 90% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

MCP Config Access

High

• Category: Agent Snooping

Content

- 官方说明与 Token 入口：<https://geo.aidso.com/apiService>。
- 价格列表：<https://geo.aidso.com/question>。

优先使用 WorkBuddy 已连接的爱搜 MCP。`.mcp.json` 通过 `${AIDSO_TOKEN}` 占位符绑定本地设置，禁止把真实凭据写进包、聊天、报告、日志、URL或命令参数。鉴权失败提示检查连接器，不根据401推断用户会员等级。用户没有可用凭据时仍可处理已提供的原始数据。

## 工具与参数差异

• Confidence: 90% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill describes operations that require file access, shell execution, and potentially networked MCP/API interaction, but it does not declare an explicit tool scope or permissions boundary. In practice this can lead to overbroad execution in hosts that infer capabilities from content, increasing the chance of unintended file modification, command execution, or external access beyond what users expect.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The README content is entirely in Chinese and does not provide any language choice, translation, or note that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for natural-language violations, this can be considered a locale/language constraint imposed without user opt-in or explicit justification.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This JSON config contains user-facing natural-language content entirely in Chinese, including product names and prompts, with no indication that the skill supports language selection or that the locale restriction is intentional. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Across all records, both the user prompts and assistant content are exclusively in Chinese, and the file does not indicate that this locale restriction is optional or justified by a region-specific purpose. This creates a natural-language policy concern because the dataset appears to enforce a single language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This manifest-style JSON contains only Chinese brand, product, and evidence strings, with no indication that the locale is optional or region-specific. Under the natural-language policy rule, forcing a specific language without user opt-in can be a policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's natural-language instructions, warnings, and operational requirements are all presented in Chinese, and there is no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill effectively forces a specific language without user opt-in.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 连接与凭据

- MCP 服务：`https://api.aidso.com/geo_api/mcp`。
- HTTP API：`https://openapi.aidso.com/geo_api/task_commit`、`https://openapi.aidso.com/geo_api/get_result`。
- 认证请求头：`aidso-token`。
- 官方说明与 Token 入口：<https://geo.aidso.com/apiService>。

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The title and the surrounding instructions are written as fixed Chinese report requirements, and the file does not indicate that language selection is optional or configurable. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: Line L29 requires names, descriptions, prompts, tags, and quick prompts to be provided in both Chinese and English, and further requires the Chinese display description to be 40–50 characters. This is a natural-language policy concern because it forces specific language output constraints without stating that the skill is region-specific or allowing user choice.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file embeds user-visible messages and labels in Chinese, such as the default brand label and multiple ValueError messages, with no indication that the skill is China-specific or that users can opt into this locale. That can violate a language/locale policy when the skill is used in broader contexts expecting language choice.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file hardcodes `ZoneInfo('Asia/Shanghai')` when converting timestamps and datetimes, which imposes a specific locale/timezone on all inputs. This is a natural-language/policy concern because the skill does not offer opt-in or document a region-specific justification for forcing that locale.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The generated document explicitly sets `lang="zh-CN"` and the rendered report content uses fixed Chinese labels throughout, which enforces a specific language/locale for all users. The policy allows locale constraints only when they are user-selectable or clearly documented as justified; this file does not show such an opt-in or justification.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The module docstring states 'never sends requests', which describes the script as purely planning/tracking. However, the `begin` flow transitions a task to `SENDING` and returns `mcp_arguments` for actual API submission, and the surrounding command set (`begin`, `record`, `result`) is explicitly built to drive real request execution and tracking. This is an active contradiction between documentation and implemented intent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file defines the required approval text as the fixed Chinese phrase '确认执行'. Because approval later requires an exact match, this enforces a specific language/locale for a core user interaction without opt-in or a documented justification, which matches the locale-policy violation criteria.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

write_json(manifest, p)
        return 0
    except (ValueError, OSError, KeyError) as exc:
        print('ERROR: ' + str(exc), file=__import__('sys').stderr)
        return 2

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

class PaidSamplingWorkflow(unittest.TestCase):
    def test_lists_only_supported_product_card_combinations_with_points(self):
        result = subprocess.run(
            [sys.executable, str(SCRIPTS / 'task_plan.py'), 'list-platforms'],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

plan_file = workspace / 'plan.json'
            plan_file.write_text(json.dumps(config(), ensure_ascii=False), encoding='utf-8')
            outside = workspace / 'tasks.json'
            result = subprocess.run(
                [sys.executable, str(SCRIPTS / 'task_plan.py'), 'plan', '--config', str(plan_file), '--out', str(outside)],
                cwd=workspace,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file contains numerous hard-coded Chinese UI strings such as '不适用', '目标商品', '报告导航', and other report labels, which indicates the skill's rendered output is fixed to Chinese. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The stylesheet hard-codes locale-specific fonts including "PingFang SC" and "Microsoft YaHei" in the global body font declaration. This expresses a specific language/locale preference without any visible user opt-in or justification, which matches the natural-language locale policy concern for all file types.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The validation logic raises multiple user-facing error messages only in Chinese, which effectively forces a specific language for interaction. This is a natural-language policy issue because the file does not offer any language or locale choice, nor document that the skill is intentionally limited to Chinese users.

Static analysis

No suspicious patterns detected.