Security audit

Brand Monitor - 品牌舆情监控

Security checks for vulnerabilities and agentic risk

Overview

This brand-monitoring skill is mostly purpose-aligned, but it needs Review because it combines shell execution, external data sharing, persistent memory, scheduled recurring runs, and credential-like examples with incomplete safeguards.

Install only if you are comfortable sending monitored brand queries to SerpAPI and reports to Feishu, and review the prompts before use. Use a non-privileged account, avoid system-wide timers unless necessary, replace any webhook-shaped examples, store API keys in a proper secret store, and require confirmation before external alerts or memory writes.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: prompts/monitor.md:21
Finding: Shell Command Injection Through Unsanitized Prompt Variables
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: prompts/monitor.md:104
Finding: Untrusted Web Content Can Be Persisted Into Agent Memory
Content: View full analysis
``` ``` It subsequently directs the Agent to save monitoring results into memory: ```text Use the `memory` tool to save monitoring data: ``` ```json { "type": "brand_monitor_report", "date": "YYYY-MM-DD", "timestamp": "ISO8601", "brand": "{{brand_name}}", "summary": { "total": 0, "positive": 0, "neutral": 0, "negative": 0, "avg_sentiment": 0, "avg_influence": 0 }, "top_mentions": [ "complete data for the top five mentions" ], "alerts": { "negative": [], "viral": [] } } ``` The stored state is consumed later by `prompts/analyze-trend.md`, lines 7-16: ```text Use the `memory_search` tool to search: ``` ```text type:brand_monitor_report brand:{{brand_name}} ``` ### Technical Analysis Search-result pages are controlled by external publishers and may contain adversarial instructions designed to manipulate an LLM. The prompt instructs the Agent to fetch full page content and later persist complete mention data, but it does not establish a trust boundary between external page text and Agent instructions. There is no instruction to sanitize fetched content, ignore commands embedded in pages, store only validated fields, or require approval before writing external content to long-term memory. Trend-analysis sessions then retrieve the stored state, allowing hostile content to influence future ses ...[truncated 1264 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: crawler/requirements.txt:1
Finding: Unpinned Dependencies Are Installed With Package Build Execution Enabled
Content: View full analysis
=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 ``` The dependencies are installed by `install.sh`, lines 29-31: ```bash echo "Installing Python dependencies..." cd crawler pip3 install -r requirements.txt ``` ### Technical Analysis The dependency declarations use lower bounds without exact version pins, upper bounds, or integrity hashes. Consequently, installation may select any future compatible release from the configured Python package index. Python package installation can execute package build logic. If a package source, distribution account, package index, or resolver path is compromised, malicious installation code may run immediately. The installer also uses the environment's global `pip3` rather than creating an isolated virtual environment. `beautifulsoup4` and `lxml` are listed but are not imported by the reviewed executable crawler, unnecessarily increasing the supply-chain attack surface. ### Attack Path 1. A malicious or compromised future package version satisfies one of the `>=` constraints. 2. A user runs `install.sh`. 3. `pip3` resolves and downloads the unreviewed version from the configured index. 4. Package installation or build logic executes with the installer's privileges. 5. The malicious dependency can alter the environment, access available credentials, or install persistent code. ### Impact Assessment Exploitation can result in arbitrary code execution with the privileges of the user running `install.sh`. If installation is performed by an administrator, the impact may become system-wide. Even without a malicious package, unconstrained upgrades can introduce incompatible or vulnerable releases and make installations non-reproducible. ]]>
Remediation: View remediation

T06 · System Persistence

Error

Location: README.md:211
Finding: System-Level Scheduled Persistence Exceeds the Minimum Privilege Required
Content: View full analysis
> /var/log/brand-monitor.log 2>&1 ``` ### Technical Analysis Recurring execution is relevant to continuous brand monitoring, but a system-wide service under `/etc/systemd/system` is not the least-privileged implementation. A system service without an explicit `User=` directive runs as root by default. The service launches a general-purpose Agent with `shell`, `web_fetch`, and messaging capabilities rather than a narrowly scoped crawler process. The service configuration also embeds the SerpAPI credential directly in an `Environment=` directive. Plaintext credentials in unit files may be exposed to users or operational tooling that can inspect service definitions or properties. Unlike a user-level timer, the documented timer persists across interactive sessions and is enabled through `sudo`, expanding both persistence and privilege scope. ### Attack Path 1. A user follows the documentation and creates the service and timer under `/etc/systemd/system`. 2. The service omits a dedicated unprivileged `User=` account and contains the SerpAPI key in plaintext. 3. The user enables the timer with `sudo systemctl enable`. 4. The Agent is invoked automatically ...[truncated 733 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: 获取飞书Webhook指南.md:57
Finding: Concrete Feishu Webhook Credential Is Hard-Coded in Documentation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (70)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 47)May include surrounding context.
��

text
### 2. 安装依赖 ```bash cd brand-monitor-skill chmod +x install.sh ./install.sh

3. 获取 SerpAPI Key

访问 https://serpapi.com/ 注册并获取免费 API Key

免费额度：100 次搜索/月

付费计划：$50/月（5000 次搜索）

4. 配置环境变量

bash
# Linux/macOS export SERPAPI_KEY='your_api_key_here' echo 'export SERPAPI_KEY="your_api_key_here"' >> ~/.bashrc source ~/.bashrc # Windows (PowerShell) $env:SERPAPI_KEY='your_api_key_here'

5. 配置 Skill

bash
cp config.example.json config.json nano config.json

最小配置：

json
{ "brand_name": "理想汽车", "feishu_webhook": "https://open.feishu.cn/open-apis/bot/v2/hook/你的webhook" }

6. 测试

bash
# 测试爬虫（Mock 模式，无需 API Key） cd crawler python search_crawler_serpapi.py "理想汽车" "weibo,zhihu" 5 24 --mock # 测试真实搜索（需要 API Key

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · crawler/SerpAPI使用指南.md (reported line 53)May include surrounding context.
��

text
### 2. 安装依赖 ```bash cd brand-monitor-skill chmod +x install.sh ./install.sh

3. 获取 SerpAPI Key

访问 https://serpapi.com/ 注册并获取免费 API Key

免费额度：100 次搜索/月

付费计划：$50/月（5000 次搜索）

4. 配置环境变量

bash
# Linux/macOS export SERPAPI_KEY='your_api_key_here' echo 'export SERPAPI_KEY="your_api_key_here"' >> ~/.bashrc source ~/.bashrc # Windows (PowerShell) $env:SERPAPI_KEY='your_api_key_here'

5. 配置 Skill

bash
cp config.example.json config.json nano config.json

最小配置：

json
{ "brand_name": "理想汽车", "feishu_webhook": "https://open.feishu.cn/open-apis/bot/v2/hook/你的webhook" }

6. 测试

bash
# 测试爬虫（Mock 模式，无需 API Key） cd crawler python search_crawler_serpapi.py "理想汽车" "weibo,zhihu" 5 24 --mock # 测试真实搜索（需要 API Key

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · 使用指南-SerpAPI版.md (reported line 49)May include surrounding context.
��

text
### 2. 安装依赖 ```bash cd brand-monitor-skill chmod +x install.sh ./install.sh

3. 获取 SerpAPI Key

访问 https://serpapi.com/ 注册并获取免费 API Key

免费额度：100 次搜索/月

付费计划：$50/月（5000 次搜索）

4. 配置环境变量

bash
# Linux/macOS export SERPAPI_KEY='your_api_key_here' echo 'export SERPAPI_KEY="your_api_key_here"' >> ~/.bashrc source ~/.bashrc # Windows (PowerShell) $env:SERPAPI_KEY='your_api_key_here'

5. 配置 Skill

bash
cp config.example.json config.json nano config.json

最小配置：

json
{ "brand_name": "理想汽车", "feishu_webhook": "https://open.feishu.cn/open-apis/bot/v2/hook/你的webhook" }

6. 测试

bash
# 测试爬虫（Mock 模式，无需 API Key） cd crawler python search_crawler_serpapi.py "理想汽车" "weibo,zhihu" 5 24 --mock # 测试真实搜索（需要 API Key

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述总体方向与代码较为相关，确实是在做品牌相关的多平台搜索监控，面向微博、小红书、知乎、抖音等国内平台，并提取部分元数据。但仍存在实质不一致：第一，声明权限为空，而代码明确发起外部 HTTP 请求到 serpapi.com，并间接访问搜索引擎结果，这是未声明的网络访问能力；第二，代码依赖 SERPAPI_KEY 环境变量，涉及外部 API 凭据使用；第三，声明称“搜索、分析品牌提及情况”，但代码的核心实际是搜索、解析、过滤和结构化输出，并没有明显的舆情分析逻辑（如情感分类、趋势判断、聚合分析等）。因此应判定为存在描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 代码的实际功能与声明目的存在明显不一致。声明描述的是一个面向新能源汽车品牌的舆情监控能力，但该代码块只是一个用于发布该技能的运维/打包脚本。它不抓取国内平台内容、不搜索品牌提及、不做情感分析或趋势分析，也没有任何监控逻辑。虽然脚本中提到了与品牌监控相关的文件名和发布说明文本，但这些只是围绕项目发布的辅助内容，不等于实现了舆情监控能力。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to rely on SerpAPI for multi-platform monitoring without clearly warning that search terms, monitored brand names, and related queries are sent to an external search provider. In a monitoring context, those queries may reveal commercial strategy, investigations, or sensitive reputation concerns to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes automatic Feishu push notifications but does not clearly disclose that monitored content, summaries, and potentially sensitive brand intelligence will be transmitted to Feishu, a third-party service. This can create an unintentional data-sharing/privacy risk, especially if monitored results include confidential internal watchlists, crisis reports, or personal data from collected content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The release notes instruct users to configure a Feishu webhook and describe monitoring and analysis of third-party brand mentions, but they do not clearly warn that collected content, summaries, or metadata may be transmitted to external services such as SerpAPI and Feishu. For a sentiment-monitoring skill that processes social-platform content, this omission can cause operators to unknowingly share potentially sensitive or regulated data outside their environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description is written as a China-specific monitoring solution focused on domestic platforms, and the skill content is entirely in Chinese without offering a language or locale choice. This can be a language/locale policy issue when a skill implicitly forces one language or regional scope for all users without documenting it as an opt-in or justified regional specialization.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation phrases are broad business-language triggers such as '执行品牌监控' and '分析品牌趋势', which can match normal conversation and cause the skill to activate unexpectedly. Because the skill can perform network collection and send results outward via webhook, accidental activation increases the chance of unintended data gathering or transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires a Feishu webhook and states reports will be pushed there, but the description does not present a strong user-facing warning that monitored content and analysis results are transmitted to an external endpoint. This is dangerous because users may trigger collection of sensitive business intelligence, complaints, or personal data without understanding that it will be exfiltrated outside the local environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This manifest-style JSON defines wide monitoring across multiple public platforms and a 24-hour monitoring window, but it does not specify clear activation boundaries, narrowing conditions, or negative examples for when the skill should not run. The limited exclude_keywords list does not fully clarify scope, which could lead to overly broad or unintended invocation/monitoring behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The configuration includes an external Feishu webhook endpoint, creating a built-in path for monitored content and analysis results to be transmitted off-system. In a brand-monitoring skill that aggregates potentially sensitive business intelligence or user-generated content, silent outbound delivery increases the risk of unintended data disclosure, misrouting, or exfiltration if operators do not clearly understand what is being sent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document promotes sending brand-monitoring queries through SerpAPI but does not disclose that search terms, target platforms, and potentially operational metadata will be transmitted to a third-party service. In a monitoring skill, those queries may reveal business interests, monitored entities, or internal investigation targets, creating privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to persist a live API key in shell startup files, which increases the chance of credential exposure through dotfile syncing, backups, shared accounts, shell history, or accidental commits. While common in developer docs, presenting this without any warning that the key is sensitive or suggesting safer secret storage is a real security weakness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description, CLI help, and status/error messages are written in Chinese, and the code also forces hl='zh-cn' for Baidu searches. This imposes a specific language/locale behavior without user opt-in or documentation that the skill is intentionally limited to a Chinese-language context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: When DEBUG is set, the code prints up to 2000 characters of the raw SerpAPI JSON response to stderr. Search results may contain sensitive query terms, personal data in snippets, or account metadata, and stderr is commonly captured by centralized logs where operators or other tenants may access it unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: All prompts, status messages, and usage guidance in the installer are written in Chinese, including the suggested agent command text. For a general-purpose skill, this imposes a specific language/locale on users without opt-in, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The user-facing comments and console output are entirely in Chinese, which effectively imposes a specific language on all users of the script. There is no opt-in, fallback language, or documentation indicating that the skill is intentionally limited to Chinese-speaking users or a specific region.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script deletes the release staging directory with rm -rf before recreating it, which is a destructive filesystem operation. Although progress messages are printed, there is no warning that existing contents at that path will be removed, no confirmation prompt, and no comment/docstring disclosing the destructive behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prompt extends a monitoring skill into operational response by instructing the agent to push alerts, notify stakeholders, and create follow-up tasks automatically. This is dangerous because it enables real-world actions beyond analysis without explicit authorization gates, increasing the risk of unwanted mass notifications, workflow disruption, or accidental escalation based on noisy or incorrect detections.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs immediate transmission of monitored content, usernames, account metadata, and potentially sensitive incident details to external systems like Feishu and SMS, including broad notifications such as @all, without any consent or warning. This creates privacy and data-governance risk and can amplify harm by disseminating inaccurate, defamatory, or sensitive user-generated content to large internal audiences.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T02 · Agent Memory Poisoning

T08 · Insecure Dependencies

T06 · System Persistence

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3. 获取 SerpAPI Key

4. 配置环境变量

5. 配置 Skill

6. 测试

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3. 获取 SerpAPI Key

4. 配置环境变量

5. 配置 Skill

6. 测试

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

3. 获取 SerpAPI Key

4. 配置环境变量

5. 配置 Skill

6. 测试

Tp4

Tp4

Lp1

Lp1

Lp1

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Vague Triggers

Missing User Warnings

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Description-Behavior Mismatch

Missing User Warnings

Static analysis