Security audit

WMS仓库收费对账

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned for WMS billing reconciliation, but it needs review because it handles WMS credentials and business billing data while under-disclosing network transmission and using broad triggers.

Install only for WMS warehouse billing reconciliation, not general accounting. Confirm the WMS base URL before running, use a least-privilege or temporary API key if possible, treat command-line credentials and generated JSON/HTML reports as sensitive, and store outputs in a private directory.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to run a local script that reads user-supplied Excel files, makes outbound API calls using provided credentials, and writes HTML/JSON/modified Excel outputs, but no permissions are declared. This creates a transparency and policy-enforcement gap: an agent or platform may execute file-write and network-capable actions without explicit user-visible approval boundaries, increasing the risk of unintended data exfiltration, credential misuse, or unsafe file modification.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: 文档声称 AppKey/AppSecret“不上传”，但代码实际将 AppKey 放入请求头、并使用 AppSecret 对请求体签名后发送到远程WMS API。这会误导用户对凭证使用方式的理解，导致在未充分知情的情况下向第三方服务暴露认证材料或其派生值。

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase at line 25 is simply '对账' ('reconciliation/account checking'), which is very broad and likely to match many unrelated user requests. Because this skill requests API credentials and has Read/Write/Bash permissions, unintended activation could cause the agent to solicit sensitive WMS secrets or perform file/system actions in the wrong context.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Several trigger phrases in this range, such as '核账', '收费核对', or fee-specific variants, can still be ambiguous without explicit warehouse/WMS context. In a skill that handles financial reconciliation and asks for AppKey/AppSecret, ambiguous activation increases the chance of the skill being invoked for unrelated accounting tasks, leading to inappropriate credential requests or unintended processing of sensitive business files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: 脚本会将账期、仓库ID及相关业务查询参数发送到远程API，但代码中没有在运行时向用户明确提示将发生网络传输。对于处理账单、运单号、退货单号等业务数据的对账工具，这种缺少透明告知会增加敏感业务信息被外发的意外风险。

Missing User Warnings

Low

Confidence: 84% confidence
Finding: 脚本默认保存详细 reconciliation_detail.json，其中包含账单摘要、API业务记录核对结果、运单号、业务单号、退货信息等较完整的业务数据，但没有显式征得用户同意或提供关闭开关。若输出目录位于共享位置、被误同步或被低权限用户访问，可能导致敏感运营数据泄露。

Static analysis

No suspicious patterns detected.