自动下单执行虾

• Outcome: Review
• Latest audit: May 28, 2026 · 2:49 PM UTC
• Version: 1.0.0

Overview

This skill is openly built for automated purchasing, but it can run persistent live order/payment automation with weak approval controls and unsafe rule-handling details.

Review carefully before installing. Do not connect this skill to real supplier, payment, or procurement accounts unless you add mandatory approval gates, a dry-run mode, hard spending caps, least-privilege test credentials, a daemon stop/kill-switch workflow, reviewed rule parsing, and removal of the eval-based budget check.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares and documents shell-based execution (`bash`, daemon mode, payment execution) but does not declare permissions or constraints for those capabilities. In a skill that can monitor conditions and trigger purchases/payments, undeclared shell access obscures the true privilege boundary and increases the risk of unauthorized command execution, hidden automation, or misuse of stored credentials.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill is explicitly designed to perform autonomous purchasing and payment, which are potentially irreversible financial actions, yet it does not present a prominent user-facing warning or require strong confirmation semantics. In this context, silent or insufficiently warned automation can cause unauthorized spending, accidental purchases, fraud amplification, and disputes before a user realizes the system is acting on triggers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to launch background monitoring (`--daemon`) and describes auto-triggered procurement based on external signals, but it does not clearly warn that the skill continuously monitors data sources and relies on external APIs that may be stale, manipulated, or unavailable. For an auto-purchasing system, continuous unattended execution combined with untrusted inputs can lead to repeated unwanted orders, trigger abuse, or actions taken on bad data.

Missing User Warnings

Low

• Confidence: 96% confidence
• Finding: The script passes database-derived trigger_condition content into an external Python evaluator, creating a dangerous trust boundary around rule input. In an auto-purchase engine, if evaluate_condition.py interprets conditions unsafely, an attacker with rule-edit capability could achieve code execution or arbitrary query manipulation and then trigger purchases automatically.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script submits live purchase orders directly to a supplier API with no approval gate, strong authentication of rule provenance, or anti-tamper controls. In this skill context, that is especially dangerous because the automation is explicitly designed to spend money and complete payment end-to-end once conditions are met.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/monitor-and-execute.sh:207