Security audit

多轮商务谈判虾

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for supplier email negotiations, but it uses high-impact email and mailbox access with unsafe script patterns that could execute unintended code and expose mailbox content.

Install only if you are prepared to review and harden the script first. Use a dedicated procurement mailbox, avoid general-purpose inboxes, keep reports out of shared or source-controlled folders, require explicit approval before bulk sends, and replace the sourced config and heredoc Python generation with safer data-only parsing before using real credentials.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/email-negotiator.sh:40
Finding: Arbitrary Python Code Execution Through Unsafe Heredoc Interpolation
Content: View full analysis
" msg['To'] = """$to""" part = MIMEText("""$body""", 'plain', 'utf-8') msg.attach(part) with smtplib.SMTP('${SMTP_HOST}', ${SMTP_PORT}) as server: server.starttls() server.login('${SMTP_USER}', '${SMTP_PASS}') server.sendmail('${SMTP_USER}', """$to""", msg.as_string()) print(f"[OK] 邮件已发送至 $to") PYEOF } ``` The mailbox parser uses the same unsafe pattern for its output path and configuration values: ```bash python3 - <
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/email-negotiator.sh:15
Finding: Arbitrary Shell Execution Through Sourced Configuration File
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/email-negotiator.sh:150
Finding: Overbroad Mailbox Collection and Plaintext Retention of Unrelated Email Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell scripts, performs bulk email sending, parses inbox contents, and writes reports, but it declares no explicit tool or permission scope. That creates an authorization gap where an agent may execute network, shell, and file operations without clear least-privilege boundaries or user-visible consent, increasing the risk of unintended data access, mass outbound messaging, or command misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill’s user-facing description and operational guidance are entirely in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill processes supplier names, email addresses, quotes, payment terms, and inbox contents at scale, yet it provides no warning or consent guidance around handling contact data and sensitive commercial communications. In this context, automated collection, parsing, and summarization of mailbox content can expose personal data and confidential pricing information, especially when combined with report generation and optional third-party notifications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This plain-text template forces a specific language for all users and does not offer any language or locale choice. Under the policy, language-specific behavior without user opt-in or documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains all user-facing negotiation templates and headings exclusively in Chinese, which can effectively force a specific language for users of the skill. The policy allows fixed-language behavior only when user opt-in is provided or the locale restriction is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains user-facing natural language content exclusively in Chinese, but it does not offer any language choice, opt-in, or explanation that the skill is intended for a Chinese-speaking or region-specific audience. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly templates storage of supplier contact emails together with detailed negotiation history, pricing concessions, and behavioral profiling, but provides no privacy, retention, access-control, or lawful-use guidance. In a procurement negotiation skill, this increases the risk of unnecessary collection and misuse of business contact data and commercially sensitive profiling information at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Comments, errors, status messages, and help output are consistently presented in Chinese, with no option to select another language or locale. This can violate language/locale policy when a skill imposes a single language on all users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The parse routine logs sender, subject, date, extracted prices, and a preview of email bodies into a CSV report without any consent, minimization, or access-control safeguards. In this skill’s procurement context, inbox contents can contain confidential commercial terms, personal data, and negotiation history, so exporting them to a local report increases the risk of unauthorized disclosure or secondary misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This plain-text email template is entirely written in Chinese and provides no indication that the recipient or user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: All user-facing instructions and content in this file are presented exclusively in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional. The policy calls for flagging language or locale constraints when they are forced without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.