Security audit

唯品会活动搜索

Security checks for vulnerabilities and agentic risk

Overview

This Vipshop promotion skill mostly does what it says, but it can automatically start account login, install a separate login skill, and reuse a stored session token.

Install only if you are comfortable with the agent using a stored Vipshop login session, starting a QR-code login flow, and installing or running the separate vipshop-user-login dependency. Prefer requiring explicit confirmation before login, dependency installation, or any query that uses your account token, and avoid using this skill for non-Vipshop shopping requests.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill performs local file reads for login tokens and sends authenticated requests to an external VIP.com endpoint, yet it declares no permissions. This creates a transparency and policy-enforcement gap: a host may permit the skill under false assumptions while the skill still accesses sensitive local state and network resources.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to automatically install and invoke another skill or fallback command-line script to perform login, which is a capability escalation beyond simple promotion lookup. This expands the trust boundary to unreviewed code and enables chained execution with account access implications, all without explicit user approval at the time of action.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documented behavior broadens from querying promotions into autonomous login-state inspection, token handling, and login orchestration. This is dangerous because a seemingly low-risk shopping information skill is effectively acting on behalf of a user account and making authentication decisions, increasing the chance of unauthorized or unexpected account interactions.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill reads authentication material from a fixed file in the user's home directory and reuses it to call a remote API, even though the stated purpose is only promotion lookup. Accessing local tokens is a sensitive capability because it silently leverages the user's logged-in session and could expose or misuse account credentials if the file is compromised, copied, or reused beyond the minimal need.

Vague Triggers

High

Confidence: 91% confidence
Finding: The trigger description is overly broad and overlaps with common shopping-related phrases, including requests about other platforms being redirected into this VIP.com skill. In context, accidental activation is more dangerous because activation can lead to local token checks, network access, and automatic login orchestration rather than a harmless read-only lookup.

Vague Triggers

High

Confidence: 89% confidence
Finding: The body repeats broad activation guidance without defining boundaries or disallowed contexts. Because this skill carries authenticated and installation side effects, unclear triggers materially raise the risk of accidental execution and unintended account-related actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill requires automatic installation and execution of login-related tooling without meaningful risk disclosure or consent. That is dangerous because it can cause the agent to fetch and run additional code and initiate an authentication flow tied to the user's account, which is a materially sensitive operation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to read a local token file and then perform authenticated network queries, but does not present this as a sensitive data-handling operation requiring consent. In context, this makes the skill more dangerous because a user asking for sale information may not expect local credential inspection and remote transmission tied to their account state.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code automatically attaches the PASSPORT_ACCESS_TOKEN cookie to an outbound request without any visible consent, warning, or runtime confirmation in this file. Silent transmission of authentication cookies increases the risk of unauthorized account-backed actions or privacy leakage, especially because users may expect a promotion query to work without touching their login session.

Static analysis

No suspicious patterns detected.