Security audit

唯品会活动搜索

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to search Vipshop promotions, but it can automatically install and run a separate login skill and use a stored Vipshop session token without a clear consent gate.

Install only if you are comfortable letting the agent use your Vipshop login session to query Vipshop APIs. Do not allow automatic installation of the separate login skill or QR-code login unless you intentionally requested it, and treat non-Vipshop shopping-platform requests as out of scope for this skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill performs file reads of local login tokens and makes authenticated network requests, yet it declares no permissions. This creates a transparency and governance gap: the agent may access local credentials and external services without users or the platform being clearly informed, which is risky in a skill that handles account-authenticated data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the AI to automatically install another skill via clawhub when login support is missing. Automatic dependency installation is a system-modifying action outside the core purpose of promotion lookup, and it expands trust to another package without explicit user approval or integrity controls.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill tells the AI to execute a login script from a sibling skill directory, which crosses skill boundaries and grants broader execution capability than simple promotion querying requires. This is dangerous because it enables arbitrary local code execution from an external component whose behavior is not constrained by this skill’s declared purpose.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill reads persisted authentication material from ~/.vipshop-user-login/tokens.json and reuses the PASSPORT_ACCESS_TOKEN to perform network requests. For a promotion-search skill, silently accessing local login state expands privileges beyond a simple public query and can expose or misuse a user's authenticated session if the skill is invoked unexpectedly or repurposed.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger scope is overly broad, claiming queries about promotions across Pinduoduo, JD, Taobao, and Tmall can activate this Vipshop skill. Overbroad routing increases the chance the skill runs in contexts the user did not intend, which is more concerning here because the skill also reads login state and may trigger installation or login actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The repeated broad activation guidance lacks clear boundaries for when the skill should run. Ambiguous invocation raises the risk of the skill activating on generic shopping queries and then performing account-state checks or initiating auxiliary login flows without strong user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs automatic installation and execution of login tooling but does not clearly warn users that it may modify the system and run commands. Lack of disclosure and consent is especially dangerous because these actions expand the agent’s capabilities beyond data retrieval into software installation and code execution.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs reading a local tokens file and using authenticated session data, but it does not provide a clear privacy notice about accessing local credentials or account-linked data. Users may not realize the skill inspects local authentication artifacts and uses them for network requests, creating consent and privacy risks.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script transmits the user's PASSPORT_ACCESS_TOKEN cookie to a remote endpoint without any explicit user-facing disclosure or runtime consent. Even though the destination uses HTTPS and appears related to Vipshop, sending session cookies from a local file creates privacy and account-risk concerns because the user may not realize their authenticated state is being used by a seemingly read-only search tool.

Static analysis

No suspicious patterns detected.