Security audit

俄罗斯血糖检测设备市场调研（即时版）

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent market-research report generator, but it ships an apparent API credential and handles user API keys in plaintext project files.

Review before installing. Remove the packaged TGStat key, treat it as exposed, and use environment variables or an untracked local config for any SerpAPI/TGStat credentials. Run the Python scripts in a virtual environment from the skill directory, keep outputs in a dedicated folder, and verify any medical-market or social-media claims before using the generated report.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs writing and executing local Python and shell commands as part of normal use, which is broader than necessary for a research/reporting skill and increases the attack surface substantially. In agentic environments, patterns that normalize arbitrary command execution can be repurposed to run unintended code, modify the host, or access local data beyond the reporting task.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The exporter accepts a caller-supplied output path and writes the generated DOCX there without constraining it to the skill's intended output directory. In an agent/skill context, if an untrusted caller can influence docx_path, this enables arbitrary local file write within the agent's filesystem permissions, which can overwrite files outside the report workspace.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly instructs users to store a live SerpAPI key in `data/data_sources.json` but provides no guidance on secret handling, file permissions, `.gitignore`, or safer alternatives such as environment variables. This creates a realistic risk of accidental credential exposure through source control, shared skill directories, backups, or generated support bundles.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill requires placing a SerpAPI key in a local data file and gives no guidance on secret storage, access control, or the privacy implications of sending research queries to a third party. This creates risk of credential leakage through the workspace and uninformed transmission of possibly sensitive business intelligence queries to an external service.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The code injects network-derived SerpAPI content from VK and Telegram directly into the generated report with only minimal truncation and character replacement. This creates a report integrity risk: untrusted third-party text and URLs can mislead recipients, embed deceptive links, or introduce unsafe/undesired markup content without any provenance warning, validation, or sanitization beyond formatting cleanup.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script directly embeds VKontakte and Telegram content into the generated report with only minimal string replacement, and without warning, provenance controls, or sanitization appropriate for untrusted social content. In a business intelligence/reporting skill, this can propagate unverified, sensitive, defamatory, or privacy-invasive content into a deliverable document, creating data handling and downstream trust risks.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The manifest hard-codes the skill language to zh-CN without any indication of user selection or locale negotiation. This can cause the agent to respond in an unexpected language, which in a medical-device market-research workflow may lead users to misunderstand instructions, outputs, or compliance-sensitive content.

Ssd 3

Medium

Confidence: 99% confidence
Finding: A live TGStat API key is hardcoded directly in the configuration file, which risks accidental disclosure through source control, logs, packaging, or downstream prompts that echo config contents. If exposed, third parties could misuse the credential for unauthorized API access, consume quota, or pivot into related workflows that trust this key.

Static analysis

No suspicious patterns detected.