唯品会图片搜索

• Outcome: Review
• Latest audit: May 28, 2026 · 1:16 PM UTC
• Version: 1.0.1

Overview

This Vipshop image-search skill works mostly as advertised, but it also turns a saved login token into user-visible authenticated product links.

Install only if you trust the publisher with your Vipshop login state and the images you search. Avoid sharing or logging generated product links, because they may contain authentication-derived account material. A safer version should use normal product URLs, request explicit consent before login or upload, and redact raw backend data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to read a local login token file and make outbound network requests, but it declares no corresponding permissions. Hidden or undeclared file-read and network capabilities weaken the trust boundary, because users and the platform cannot accurately assess what local data and external services the skill will access. In this context, the file access targets authentication material, which makes the omission more sensitive than a routine local read.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to perform image-based product search, but the described behavior also reads login tokens/cookies from ~/.vipshop-user-login/tokens.json, derives authentication values, and constructs token-bearing passport exchange links. This is a significant behavior mismatch because it processes sensitive credentials and generates authenticated URLs that could be exposed in output, logs, or downstream handling, expanding the risk from simple search to credential misuse or account-session abuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads a persisted PASSPORT_ACCESS_TOKEN from the user's home directory and uses it to construct authenticated exchange links. In an image-search skill, harvesting a local login token and embedding it into generated URLs is unrelated to the declared functionality and can expose or misuse a user's authenticated session for account-linked actions or tracking.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This code's primary purpose is to generate authenticated exchange-token links to VIPShop rather than perform image-based product search as described in the skill metadata. That mismatch is dangerous because it indicates hidden capability to transform a local access token into a reusable authenticated link flow, which can facilitate unauthorized session use, deceptive redirection, or covert credential-backed actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill reads persistent authentication tokens from a fixed path in the user's home directory and then uses them to perform remote requests. That is sensitive credential access beyond simple local image handling, and the manifest does not clearly justify direct filesystem token harvesting as part of image search, increasing privacy and abuse risk if the skill is invoked unexpectedly or repurposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to automatically trigger an account login flow when the user is not logged in, without a clear user-facing warning or consent checkpoint. Automatic initiation of authentication-related actions can surprise users, cause unintended account access, and normalize silent handling of credentials, which is especially risky in a skill that already depends on stored login state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script accesses a sensitive local access token store without any clear user disclosure, consent, or necessity for the advertised feature. Even if intended for convenience, silently reading authentication material violates least-privilege expectations and creates risk of unauthorized use or downstream leakage through generated URLs and logs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When a local file path is provided, the skill uploads the image contents to a remote VIPShop endpoint without any explicit user-facing confirmation at the point of transfer. Because local images may contain personal or sensitive content, silent exfiltration to a third-party service creates a meaningful privacy risk even if it is functionally required for the feature.

Static analysis

No suspicious patterns detected.