商铺选址分析工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:39 AM UTC
• Version: 1.0.3

Overview

The skill is purpose-aligned, but needs Review because its report generation can overwrite writable files, expose an AMap key, and allow script injection in generated HTML.

Install only if you trust the operator and can run it with limited filesystem permissions. Use a dedicated output directory, do not let untrusted users control output_dir or address strings, configure a separate browser-safe AMAP_JS_KEY, and rotate AMAP_KEY if it has already appeared in shared reports.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: heatmap_template.html:60

Finding

Stored JavaScript Injection in Generated Heatmap Reports

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.py:284

Finding

User-Controlled File Placement and Overwrite

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.py:10

Finding

Server-Side Amap Credential Exposed in Generated HTML

Content

View full analysis

``` The comparison template uses the same pattern: ```html ``` ### Technical Analysis A browser-side map key is necessarily visible to users of the resulting page. However, this implementation falls back to the server-side Web Service key when `AMAP_JS_KEY` is not configured. As a result, the more sensitive server credential is embedded in cleartext in every generated HTML report and in the external script URL. The key can consequently be exposed through: - The generated file's source. - Browser history. - Proxy or web-server logs. - Shared report artifacts. - URL and request telemetry. - Referrer propagation, depending on browser policy and subsequent navigation. The documentation describes `AMAP_JS_KEY` as optional, making this unsafe fallback part of the expected configuration path rather than an exceptional condition. ### Attack Path 1. An operator configures the required `AMAP_KEY` but does not configure the optional `AMAP_JS_KEY`. 2. At import time, `AMAP_JS_KEY` receives the value of `AMAP_KEY`. 3. A heatmap or comparison report is generated. 4. The server-side key is inserted into the Amap JavaScript URL in the HTML. 5. A recipient opens or inspects the report and extracts the credential. 6. The credential is reused for unauthorized Amap API requests until it is revoked or restricted. ### Impact Assessment A disclosed key can be used to consume API quota, cause service exhaustion, generat ...[truncated 503 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: compare_template.html:7

Finding

Runtime Execution of Third-Party CDN Script Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Every generated comparison report downloads and executes Chart.js from a third-party CDN when the report is opened. Although a specific package version is present in the URL, the document does not include a Subresource Integrity hash. The browser therefore has no cryptographic mechanism to verify that the fetched bytes match the artifact reviewed by the Skill author. If the CDN, package distribution channel, or referenced artifact is compromised or unexpectedly changed, attacker-controlled JavaScript would execute in generated reports. The effective code executed by a report can therefore differ from the static Skill package that was audited. The Amap JavaScript API is also loaded remotely, but it is an essential component of the declared interactive-map functionality. The Chart.js dependency can more readily be vendored as an immutable local asset. ### Attack Path 1. An attacker compromises the CDN delivery path, package artifact, or related distribution infrastructure. 2. A victim opens a generated comparison report. 3. The browser requests the Chart.js URL from the third-party CDN. 4. Without an integrity attribute, the browser accepts any successfully delivered JavaScript. 5. The malicious response executes with access to the report's browser context and embedded data. ### Impact Assessment Compromised dependency code could: - Read addresses, coordinates, competitor locations, rankings, and report contents. - Exfiltrate report data to an attacker-controlled service. - Alter recommendations or visualizations. - Redirect the victim or display phishing content. - Access other browser-visible information available to the report context. The impact is limited to ...[truncated 168 chars]

Remediation

View remediation

``` 3. Verify the hash against the exact distributed artifact before deployment. 4. Use an explicit file path rather than relying on the package root's default-file resolution. 5. Add a Content Security Policy restricting scripts to approved sources and hashes. 6. Pin Python dependencies to reviewed versions and hashes as well, rather than using only open-ended minimum versions. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill declares access to environment variables, file writing, and network-backed behavior in its specification, but does not declare any explicit tool scope or permission boundaries. That makes it easier for an agent runtime to grant broader-than-necessary capabilities, increasing the risk of unintended outbound requests, secret exposure from env usage, or arbitrary file creation via generated HTML outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The single-address trigger conditions are broad enough that ordinary conversational requests about opening a store or evaluating a location may auto-trigger this skill without strong confirmation. In a skill with network access and file generation, overbroad activation can cause unintended third-party API calls, unnecessary processing of user-supplied addresses, and creation of artifacts the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The multi-address compare trigger is also loosely defined and could match general comparative questions, causing the skill to launch multiple parallel analyses. Because this mode amplifies network usage and data handling across 2-5 addresses, accidental triggering increases the blast radius through extra API consumption, potential leakage of location data to external services, and more generated output files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML declares lang="zh-CN" and all visible UI strings are fixed in Chinese, which imposes a specific language/locale on users. Under the policy, locale constraints should either be user-selectable or clearly documented as intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code contains user-facing natural-language strings exclusively in Chinese, beginning with the startup error at L014 and continuing throughout summaries and validation messages. The file does not offer a language/locale option or document that the skill is intentionally limited to a Chinese-speaking or region-specific context, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill writes persistent HTML reports to the filesystem even though the description emphasizes a simple one-sentence site-selection evaluation. Undisclosed file creation expands the skill's effective capability, may expose analyzed addresses and business intelligence on shared systems, and can surprise operators who did not expect persistent artifacts.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · index.py (reported line 262)May include surrounding context.

python

} for r in results],
        table_data={k: v for k, v in table_data.items()},
        amap_js_key=AMAP_JS_KEY,
        timestamp=__import__("datetime").datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    )

    os.makedirs(os.path.dirname(output_path), exist_ok=True)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The multi-address comparison path also generates and stores HTML reports, which is an additional persistence behavior not disclosed in the manifest. Because the report aggregates multiple candidate locations and rankings, the stored output could reveal more sensitive commercial planning data than a transient textual response.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown explicitly states that the skill automatically generates interactive HTML heatmaps, and later examples show concrete file paths under /tmp where outputs are written. Because this behavior affects the local filesystem, the skill description should clearly disclose that files will be created and where they will be stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document declares lang="zh-CN" and presents the UI text entirely in Simplified Chinese, which imposes a specific language/locale by default. Under the policy, locale constraints should either be user-selectable or clearly documented as justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest frames the skill as a store site analysis tool, but does not disclose that it depends on reading secret credentials from process environment variables. While this may be an implementation detail, environment secret access is a capability that is not evident from the stated purpose alone.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency specification uses a lower-bound version only (aiohttp>=3.9.0) rather than a pinned or tightly constrained version. This makes builds non-reproducible and can cause the environment to resolve to vulnerable or incompatible releases over time, especially for a network-facing HTTP library like aiohttp.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

aiohttp>=3.9.0
jinja2>=3.1.0

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Because aiohttp is not pinned, it is impossible to verify from this manifest whether the installed version avoids the listed advisories. In a skill that likely performs network requests to external APIs, uncertainty around the exact aiohttp version increases supply-chain and runtime risk, even if the manifest does not itself prove an exploitable CVE is present.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency specification uses a lower-bound version only (jinja2>=3.1.0) instead of an exact pin or controlled range. This allows future installs to pull different versions, which undermines reproducibility and may introduce known-vulnerable releases or behavior changes into a templating component that is often security-sensitive.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

aiohttp>=3.9.0
jinja2>=3.1.0

Unverifiable Dependency: jinja2 has 16 known advisory(ies) (CVE-2019-10906 (Jinja2 sandbox escape via string formatting); CVE-2014-1402 (Incorrect Privilege Assignment in Jinja2); CVE-2025-27516 (Jinja2 vulnerable to sandbox breakout through attr filter selecting format metho) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Because jinja2 is unpinned, the manifest does not establish whether deployment will use a version affected by any known Jinja2 advisories. Since templating libraries can become high-risk when used with untrusted input or sandbox assumptions, leaving the version unresolved creates unnecessary security ambiguity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description is written entirely in Chinese and presents the skill as Chinese-language oriented, but the manifest does not indicate that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, locale or language constraints should either be opt-in or explicitly justified.

Content

No source excerpt is available for this finding.