Security audit

唯品会图片搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill performs Vipshop image search, but it also uses stored login tokens to generate signed account-linked product URLs with weak disclosure.

Review before installing. Use only images you are comfortable uploading to Vipshop, assume searches use your logged-in Vipshop session, and avoid sharing generated product links or transcripts because links may contain session-derived authentication data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill directs the agent to read a local token file and make outbound network requests, but the skill metadata does not declare those capabilities. This reduces transparency and prevents meaningful consent or policy enforcement around sensitive file access and image upload behavior.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose is image-based product search, but the behavior also includes reading local login tokens and constructing authenticated passport.vip.com exchange-token links using a hardcoded secret and token-derived signing flow. That is materially more sensitive than the declared function and can expose account-authentication artifacts or enable unintended authenticated actions via generated links.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file adds a capability to read a locally stored VIPShop login token and generate signed exchange-token URLs, which is materially broader than the declared image-search product retrieval purpose. That mismatch is dangerous because it enables account-bound link generation and token-mediated access flows without clear user consent, increasing the chance of credential misuse or unauthorized session bridging.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code reads PASSPORT_ACCESS_TOKEN from ~/.vipshop-user-login/tokens.json and uses it to construct exchange links, which is a sensitive local credential access pattern unrelated to basic image search. Accessing a user's local token store without necessity or clear consent can enable account impersonation, unauthorized authenticated requests, or silent expansion of the skill's privileges.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The script hardcodes a static secret used to generate HMAC signatures for exchange-token URLs. Embedding secrets in code is dangerous because anyone with code access can extract and reuse the secret to forge signed links, abuse backend trust assumptions, and potentially bypass intended access controls.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill reads persistent login tokens from the user's home directory and uses them to authenticate remote requests without any explicit user consent at runtime. This creates a sensitive-data exposure and ambient-authority problem: any invocation of the skill can silently act with the user's account context, and compromise or misuse of the skill would let an attacker leverage stored credentials.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The skill returns raw backend response data in the "原始数据" field in addition to the structured product output described by the manifest. Even if intended for debugging, raw API payloads can contain extra metadata, internal fields, tokens, or identifiers that exceed least-privilege output expectations and may leak unnecessary data to downstream consumers.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill instructs the agent to automatically trigger login and continue searching without clearly warning the user that local login tokens will be checked and that the user's image will be uploaded to remote services. This removes informed consent around sensitive local-state access and external data transmission.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The requirement to fully display all returned data lacks safeguards for sensitive fields that may appear in API responses, account-linked URLs, tokens, or backend metadata. Without redaction rules, the skill can leak information back into the chat that should remain internal.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script silently accesses a sensitive local token file while DEBUG is off, so the behavior may occur without any user-facing disclosure. Even if no exfiltration is shown here, undisclosed access to local authentication material violates least surprise and can facilitate stealthy credential use within the skill.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: When a local file is provided, the skill uploads the image to a remote server, but the user-facing behavior does not clearly disclose that their local content will leave the device. Images may contain sensitive personal, biometric, or location-related information, so undisclosed transmission creates a meaningful privacy risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code loads locally stored login credentials and uses them in outbound requests without a user-visible notice or consent step. This is dangerous because the skill silently operates under the user's authenticated session, which can surprise users and expands the damage if the skill is abused or invoked unexpectedly.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Mandating full display of all script-returned data, especially raw data fields, creates a direct data exposure risk. In this skill's context, responses may contain authenticated product links, internal API payloads, identifiers, or token-adjacent information that should not be echoed to the user.

Static analysis

No suspicious patterns detected.