Security audit

自动客服应答虾

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate customer-service bot skill, but it needs review because it can handle sensitive customer conversations and run an unauthenticated local network service without enough safeguards.

Review before installing in a live support environment. Bind the server to localhost or place it behind authentication, fix safe argument passing in the import script, require confirmation before service control or knowledge-base writes, and add clear privacy rules for what customer data is logged, how long it is kept, who can access it, and how it can be deleted.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger terms are extremely broad and overlap with normal support-related conversation, making accidental invocation likely. In combination with shell and file-management instructions, over-triggering increases the chance that the skill is selected in contexts where operational actions or sensitive data handling were not intended.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs operators to record full customer conversations, matched answers, and feedback, but provides no notice, retention limits, access controls, or privacy safeguards. Because this is a customer-service skill, the logged content can include personal data, account issues, complaints, and other sensitive information, raising meaningful privacy and compliance risk.

Static analysis

No suspicious patterns detected.