T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:1- Finding
Broad Skill Routing Can Override the User's Intended Shopping Platform
- Content
View full analysis
- Remediation
View remediation
Security audit
唯品会商品搜索
Security checks for vulnerabilities and agentic risk
Overview
This Vipshop search skill needs review because it automatically starts account-login workflows and can expose a recoverable account token inside product links.
Install only if you are comfortable with the skill reading your Vipshop login token, making authenticated Vipshop requests, installing/running a separate login skill, and producing product links that may contain recoverable account credentials. The token-in-URL behavior should be fixed before normal use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/exchange_link_builder.py:160- Finding
Authentication Token Is Reversibly Encoded into User-Visible Product URLs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/exchange_link_builder.py:39- Finding
Hardcoded Shared Signing Secret Enables Offline Signature Generation
- Content
View full analysis
str: """ Get the secret key. Returns: The secret key string. """ return "5fb86e55b72bfc50f083049130e5e76a75c2cbda6bbd6e51d59668057f5c1715" ``` The key is used to calculate an HMAC-MD5 signature: ```python signature = hmac.new( secret.encode("utf-8"), data.encode("utf-8"), hashlib.md5 ).hexdigest() result = signature.upper() ``` ### Technical Analysis A secret embedded in a distributed client package is available to every package recipient and must be treated as publicly compromised. The code uses the value as an HMAC key for exchange-link payloads. An attacker who reads the source can reproduce the signing operation without interacting with a trusted signer. HMAC-MD5 remains a keyed construction, but the primary failure here is key disclosure rather than the digest algorithm alone. Once the HMAC key is known, integrity and authenticity guarantees collapse because an attacker can create valid signatures for attacker-selected payloads. The exact server-side acceptance rules were not available during static review. Exploitability therefore depends on whether Vipshop trusts this shared key and whether additional server-side token, timestamp, audience, destination, and replay validation is enforced. ### Attack Path 1. An attacker downloads or inspects the skill package. 2. The attacker extracts the hardcoded signing key. 3. The attacker constructs a chosen Base64-encoded exchange payload. 4. The attacker calculates the uppercase HMAC-MD5 value using the exposed key. 5. The attacker submits the forged `dt` and `sg` values to the exchange endpoint. 6. If the backend relies on this HMAC as an authenticity boundary without sufficient additional checks, it accepts an attacker-generated signed payload. ### Imp ...[truncated 515 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:26- Finding
Automatic Installation and Execution of an Unpinned External Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (32)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs the agent to automatically install and trigger a login flow, wait for QR-code scanning, and continue after login without meaningful consent gating or risk disclosure. This is dangerous because it initiates an authentication workflow and dependency installation automatically, exposing the user to credential, privacy, and environment-modification risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill actually generates device identifiers and persists them locally without clearly declaring that behavior, it expands tracking and local state management beyond a simple search function. Undeclared persistence can create privacy and auditability concerns, especially when combined with login state and cross-skill workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill actually generates device identifiers and persists them locally without clearly declaring that behavior, it expands tracking and local state management beyond a simple search function. Undeclared persistence can create privacy and auditability concerns, especially when combined with login state and cross-skill workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill actually generates device identifiers and persists them locally without clearly declaring that behavior, it expands tracking and local state management beyond a simple search function. Undeclared persistence can create privacy and auditability concerns, especially when combined with login state and cross-skill workflows.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger conditions are extremely broad, covering generic shopping language and even mentions of other platforms, which creates a high risk of over-triggering. In context, overbroad activation is more dangerous because the skill can automatically initiate login, installation, and cross-skill actions when the user may have intended only casual discussion or a different platform.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The overview repeats ambiguous activation conditions without clear limits, reinforcing the chance that the skill will activate inappropriately. Because this skill also prescribes automatic account actions, ambiguous scope materially increases the risk of unintended execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
描述文本明确写明“当用户请求搜索唯品会商品时使用此 skill”，整体文档和交互示例均固定为中文指令与中文输出，没有提供用户语言选择或 opt-in 机制。根据规则，强制特定语言或 locale 而无用户选择属于自然语言政策问题。
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Very broad triggers such as '下一页', '第5个', and '详情10' can collide with ordinary conversation and unintentionally cause stateful follow-up actions. Because these actions may invoke scripts or other skills using prior context, accidental triggering can lead to unanticipated network requests or disclosure of prior search context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instruction that users can 'directly enter a product keyword' is overly broad and lacks boundaries for when the skill should activate. This can cause the agent to treat general shopping-related text as authorization to run the search script, increasing the chance of unintended execution and external requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README extends a product-search skill into automatically installing and invoking a separate login skill, creating cross-skill execution not declared in the manifest. This can cause unexpected code execution and credential-handling workflows without explicit user consent, which is especially sensitive because it operates on authentication state and local token files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Auto-installing another skill with
clawhub install vipshop-user-loginis an unjustified capability for a product-search skill and introduces supply-chain and arbitrary code execution risk. Installation changes the local environment and may fetch unreviewed code without clear authorization from the user.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README adds product-detail retrieval behavior via another skill/script that is not described in the manifest, expanding scope beyond simple product search. Undeclared secondary actions increase the chance of surprising tool use and create a hidden execution path that may access additional data or perform unintended network requests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill documents file access, file writes, and network-dependent behavior but does not declare any explicit tool scope or permissions boundary. This weakens reviewability and containment, making it harder to enforce least privilege and easier for the skill to perform broader actions than users expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill documentation and prescribed user interaction phrases are written only in Chinese, with no indication that the user may choose another language or that the locale restriction is intentional and justified. This can violate a language-choice policy when a skill implicitly requires a specific language without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documented automatic login flow performs installation and account-login actions without prior explicit consent for system changes and account interaction. This is dangerous because it combines environment modification with authentication steps, potentially surprising users and normalizing silent escalation from a simple shopping request to sensitive account operations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the AI to install another skill automatically via
clawhub install, which is a system-changing action unrelated to a narrow search request. Auto-installing additional components increases supply-chain and privilege-expansion risk because the user asked to search products, not to modify the environment.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs execution of a separate login script from another skill directory, crossing trust boundaries and coupling a search action with account-login orchestration. Executing external scripts with blocking login behavior can expose credentials, tokens, or unintended side effects while obscuring which component is responsible for account access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill extends from product search into product-detail retrieval by calling another skill, but that broader behavior is not reflected in the manifest. Hidden functional expansion matters because it increases accessible data flows and tool usage beyond what a reviewer or user would expect from a simple search skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill mandates automatic login triggering and forbids merely notifying the user, effectively removing user control over an account-sensitive action. In the context of a shopping skill, this is an unnecessary and risky escalation because the user may not intend to authenticate or grant account access simply to discuss products.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
技能清单声明该技能通过执行 search.py 进行关键词搜索并返回商品信息，聚焦于搜索、比价和折扣发现。但该文件的模块说明和后续实现实际是读取登录 token、生成带签名的 exchangeTokenFromApp 跳转链接，用于构造登录态商品详情访问链接，而不是执行搜索或返回搜索结果。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script reads a stored login token and uses a built-in secret to generate signed account-bound exchange links, which exceeds the expected behavior of a simple product-search skill. In this context, that creates a hidden session-transfer/navigation capability that could move a user into an authenticated VIPShop context without transparent consent, increasing the risk of account misuse and unauthorized authenticated actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code silently reads PASSPORT_ACCESS_TOKEN from a local token store under the user's home directory with no user-facing warning, consent prompt, or access control visible in this file. In a skill advertised for shopping/search, covertly consuming stored login state is dangerous because it normalizes hidden use of authentication material and can enable authenticated requests or impersonation if reused elsewhere.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module persists a stable device identifier under the user's home directory even though the skill is presented as a product-search capability. Persistent identifiers enable cross-session tracking and create hidden local state that outlives a single search request, which is unnecessary for the stated functionality unless clearly disclosed and justified by the login flow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Managing a long-lived device fingerprint is broader than what a shopping search skill would normally need, and it can be repurposed for user/session correlation. In this skill context, the capability is more suspicious because the manifest emphasizes search and price comparison, while persistent fingerprinting introduces tracking behavior not obvious to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code writes a persistent device identifier to disk silently during normal execution, without any user-facing disclosure or consent path. Hidden persistence of an identifier increases privacy risk, can surprise users, and is more concerning here because the skill is framed as simple product search rather than local device/profile management.
- Content
Static analysis
No suspicious patterns detected.