other
Warning
- Location
work4week16JujingClient.py:39- Finding
Undisclosed Transmission of User Prompts and MCP Business Data to an External LLM Provider
- Content
View full analysis
- Remediation
View remediation
Security audit
ecommerce-carbon-analyzer
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-aligned for ecommerce carbon and cost analysis, but it under-discloses that user prompts and MCP-derived business data are sent to an external LLM provider.
Review before installing in any environment with real customer, pricing, inventory, warehouse, or shipment data. Only use it if sending prompts and tool-derived business records to SiliconFlow is approved for your organization, or modify it to use an approved local/private model and add clear consent and redaction controls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are broad keyword and intent matches that can activate the skill for loosely related ecommerce or shipping questions, causing the agent to invoke a tool-capable workflow unexpectedly. In this skill, unintended activation is more concerning because the description indicates MCP access to ecommerce databases and multi-step automated reasoning, which increases the chance of unnecessary data access or costly tool calls.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The client sends system prompts, user prompts, and subsequent tool interaction context to a third-party LLM endpoint. In this skill, those prompts and tool outputs can contain ecommerce product, BOM, warehouse, pricing, shipping, and carbon-calculation data sourced via MCP, so the code creates an unnecessary external data-exfiltration path beyond the local MCP/database role described by the skill. The context makes this more dangerous because the skill is explicitly designed to access internal commerce data and then relay that context into the remote model over multiple rounds.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The code is configured to communicate with an external API endpoint at api.siliconflow.cn. An external network destination is not inherently malicious, but here it materially increases data exposure risk because the application forwards conversation contents and tool-derived business data to that service. In the context of an ecommerce analysis skill with MCP-backed internal data access, this outbound transmission meaningfully expands the trust boundary.
- Content
python # 2. 初始化 LLM 客户端 llm_client = OpenAI( api_key=os.getenv('SILICONFLOW_API_KEY'), base_url="https://api.siliconflow.cn/v1", ) messages = [
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The embedded system prompt and example user interaction are entirely in Chinese and instruct the agent to behave as a Chinese-speaking logistics analyst, with no visible opt-in or alternative locale handling. This can violate language/locale policy because the skill appears to force a specific language experience rather than offering a user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains multiple natural-language comments, docstrings, sample product names, and stderr messages exclusively in Chinese, such as the server description and initialization output. Because the skill does not provide any user opt-in or state that it is intentionally region- or language-specific, it appears to force a specific language/locale in violation of the policy.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python """) conn.commit() conn.close() print("数据库初始化完成", file=__import__('sys').stderr) except Exception as e: print(f"数据库初始化失败: {e}", file=__import__('sys').stderr)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python conn.close() print("数据库初始化完成", file=__import__('sys').stderr) except Exception as e: print(f"数据库初始化失败: {e}", file=__import__('sys').stderr) @mcp.tool()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The manifest description, headings, trigger examples, and usage guidance are presented entirely in Chinese, and the file does not state that users may interact in other languages or choose their preferred locale. This can be a natural-language policy concern when a skill appears to enforce a specific language without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.