Security audit

Yunlv Customs Scout

Security checks for vulnerabilities and agentic risk

Overview

The skill is a customs-lead prospecting helper, but it overstates data-backed capabilities and has unclear remote/local data handling for sensitive business prospecting workflows.

Review before installing. Treat outputs as heuristic unless you can verify the underlying customs records and contact sources yourself, confirm whether any query data is sent to Yunlv's remote API, and require explicit user approval before exporting lead lists or contacting people through email, WhatsApp, or LinkedIn.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill presents itself as a customs/trade-intelligence capability but the documented file provides only prompts, scoring logic, and report templates—not an auditable mechanism for retrieving or validating actual customs data. This can mislead users into acting on fabricated or heuristic output as if it were verified market intelligence, creating business, compliance, and privacy risks when the tool is used for competitor targeting and outreach.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation description is broad enough to trigger on general market-intelligence or customer-mining conversations without confirming that the user actually wants customs-data prospecting. Over-broad invocation increases the chance the skill is loaded in unrelated contexts and starts producing competitor-targeting, contact-mining, or outreach guidance without adequate user intent or consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger list contains generic phrases like trade intelligence and procurement-record concepts that can appear in ordinary business discussions. Such broad triggers raise the risk of accidental activation and unsolicited generation of sensitive lead-mining or competitor-analysis workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The standalone trigger entries are not constrained by context, intent, or user authorization, so the skill may activate on routine mentions of competitor analysis, purchase records, or importers. In a skill that supports prospecting and outreach, accidental activation can expose users to unnecessary privacy, compliance, and data-governance risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Security & Privacy section states that query conditions and intermediate enterprise data are processed locally, but the manifest declares a remote API for customs-data queries. This contradiction can cause users or downstream systems to share sensitive search targets, competitor names, or prospecting activity externally under a false assumption of local-only handling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The permission boundary forbids unauthorized third-party data sources, yet the workflow explicitly includes matching social media data and LinkedIn outreach. That ambiguity weakens data-governance boundaries and may normalize collecting or using third-party personal/contact data without a clearly authorized source or consent basis.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger list contains several generic business-intelligence phrases such as '采购记录', '进口商查询', and 'trade intelligence' that can match ordinary sales or market-research requests not specifically intended for customs-data workflows. This can cause the skill to be invoked too broadly, increasing the chance that users are routed into competitor-customer mining or contact-enrichment behavior without clear intent boundaries, which is risky given the skill's stated focus on buyer discovery and competitor client mining.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill document is written in Chinese and does not indicate that language selection is optional or configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file presents the skill as a general template library, but the actual email bodies are written in English while the surrounding instructions are in Chinese. Because no language preference, opt-in, or justification is provided, the file effectively steers users toward a specific output language and may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains user-facing natural-language descriptions and command help in Chinese only, including the module docstring and CLI command labels. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is advertised as customs/import-export intelligence, but this code only applies simple keyword and heuristic scoring to user-provided inputs and never retrieves or validates real trade data. In a business-intelligence context, this is dangerous because users may make sourcing, compliance, or sales decisions under the false assumption that outputs are evidence-based market analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The competitor-mining feature claims trade-record-based customer mining, but it accepts caller-supplied customer counts and can fabricate sample quality scores when none are provided. This creates a strong risk of deceptive or hallucinated prospecting intelligence, which is especially concerning because the skill's purpose is explicitly to identify competitor customers from customs data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The argparse descriptions, subcommand help, argument help text, and fallback error message are all presented only in Chinese. This imposes a fixed language on users and does not provide a choice or documented regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The markdown states that personalized outreach emails are generated in English, German, French, and similar languages, but it does not say this depends on user preference or recipient locale choice. This can create an implicit language-forcing behavior contrary to language/locale choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest centers activation on Chinese phrases and Chinese-language market terminology, with only limited English coverage, but does not state that the skill is region-specific or offer a language preference option. This can create a language-policy issue if the broader system is expected to respect user locale choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The branding and command descriptions present the module as a customs-intelligence tool, but the implementation is only offline rule-based scoring. This mismatch increases the chance that operators overtrust the tool and treat speculative outputs as real market intelligence.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.