Ecommerce Review Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 1.0.7

Overview

This skill is a disclosed ecommerce review scraper and report generator, with privacy and dependency cautions but no evidence of hidden, destructive, or deceptive behavior.

Install only if you are comfortable using an authenticated browser session to gather ecommerce reviews and creating local reports that may include usernames, dates, and full comments. Prefer running it in a scoped browser session and pinning dependencies in a virtual environment before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

dependencies: "pip install jieba python-docx fpdf2"

Technical Analysis

The skill declares three Python dependencies without exact version constraints or cryptographic integrity hashes. If this installation instruction is honored, pip will resolve whatever package versions are available from its configured package index at installation time.

Consequently, the installed code is not reproducible and may change after the skill has been reviewed. A compromised package release, compromised package-maintainer account, or unsafe package-index configuration could cause attacker-controlled package code to be installed. Python packages may execute build or installation logic during installation, and their imported modules execute with the privileges of the process running the skill.

The reviewed package names are not visibly misspelled or sourced from disguised URLs. The risk arises specifically from unconstrained dependency resolution and absent integrity verification; the audit found no evidence that the listed packages are currently malicious.

Attack Path

1. An attacker compromises one of the declared packages, its maintainer account, or a package index trusted by the target environment.
2. The attacker publishes a malicious release under the expected package name.
3. A user or agent follows the declaration and runs:

   bash

   pip install jieba python-docx fpdf2
   

4. Because no versions or hashes are specified, pip may resolve and download the attacker-controlled release.
5. Malicious installation logic or imported package code executes with the privileges and environmental access of the Python process.
6. Depending on those privileges, the payload could access local files, generated reports, environment variables, or browser ...[truncated 789 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unconstrained installation command with exact, reviewed version pins, for example:

   text

   jieba==<reviewed-version>
   python-docx==<reviewed-version>
   fpdf2==<reviewed-version>
   

2. Store dependencies in a lock or requirements file containing SHA-256 hashes and install them with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Generate and review the lock file from a trusted package index, and explicitly configure the approved index rather than relying on mutable global pip settings.
4. Install dependencies inside a dedicated virtual environment or similarly isolated runtime using a non-privileged account.
5. Prevent dependency installation from receiving unnecessary secrets, authenticated browser state, or write access to unrelated files.
6. Scan and review dependency updates before changing pinned versions, including transitive dependencies and package provenance.
7. Avoid executing dependency installation automatically when the skill is loaded; require an explicit, reviewable setup step.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger “帮我分析这个产品的用户反馈” is broad natural language that could overlap with many generic product-feedback requests rather than uniquely signaling this specific skill. The description does not provide tighter trigger constraints or exclusion examples to clarify when the skill should activate versus when a general analysis skill should handle the request.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly relies on the user's logged-in browser session and instructs collection of full review content and user identifiers for inclusion in generated reports. In this context, inherited authenticated access combined with bulk scraping and persistent export increases the risk of unauthorized data harvesting, over-collection, and leakage of personal or account-scoped information beyond what the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill exports scraped review text and user identifiers into local Word/PDF reports without a clear upfront warning about data capture, retention, and local storage. Because the content is gathered from authenticated sessions and includes usernames plus full comments, users may unknowingly create persistent files containing personal or account-linked data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The notes state only that the skill supports Chinese review analysis, while the rest of the document includes mixed Chinese and English examples and report content, creating a locale expectation without explicit user opt-in or choice. This can violate language/locale policy when a skill effectively constrains operation or output language by default without documenting an optional selection.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

Static analysis

No suspicious patterns detected.