Security audit

China Research

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent market-research purpose, but its documented command examples put user-provided topics directly into shell commands, creating a real command-injection risk if followed literally.

Review this skill before installing. It should only be used with non-confidential research topics, and its command examples should be rewritten to use structured tool calls or shell-safe argument passing before an agent follows them literally.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:29
Finding: User-Controlled Research Topic Can Trigger Shell Command Injection
Content: View full analysis
site:xiaohongshu.com OR site:zhihu.com OR site:weibo.com" ``` ```bash mcporter call glm-search.webSearchPrime search_query="<话题> 痛点 site:v2ex.com OR site:jike.city OR site:sspai.com" ``` ```bash mcporter call glm-search.webSearchPrime search_query="<话题> site:36kr.com OR site:huxiu.com" ``` ```bash mcporter call glm-search.webSearchPrime search_query="<话题> 推荐 site:zhihu.com OR site:v2ex.com" ``` The unsafe pattern is also documented in `references/platforms.md`, lines 58-67: ```bash mcporter call glm-search.webSearchPrime search_query="<话题> site:xiaohongshu.com OR site:weibo.com" mcporter call glm-search.webSearchPrime search_query="<话题> site:zhihu.com OR site:v2ex.com" mcporter call glm-search.webSearchPrime search_query="<话题> site:36kr.com OR site:huxiu.com" mcporter call glm-search.webSearchPrime search_query="<话题> 体验 site:jike.city OR site:sspai.com" ``` ### Technical Analysis The skill instructs an agent to obtain a research topic from the user and substitute that value directly for the `<话题>` placeholder in shell command templates. Although the resulting search query is enclosed in double quotes, double-quoted shell strings still evaluate command substitutions such as `$(command)` and legacy backtick syntax. Consequently, if the agent constructs these commands as strings and executes them through a shell, a malicious topic can be interpreted by the shell before `mcporter` receives the `search_query` argument. The intended data value therefore crosses into a command-execution context without validation or shell-safe argument handling. This is an exploitable coding flaw in the skill ...[truncated 1592 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are broad enough to match many generic requests about trends, research, or feedback, which can cause the skill to activate when the user did not intend to use an external research workflow. In this skill’s context, that matters because activation leads to multi-round external searches and synthesis, increasing the chance of unnecessary data disclosure and unexpected behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill sends user-provided topics to external search services but does not warn the user or obtain clear consent first. This is dangerous because user prompts may contain sensitive business plans, personal interests, or proprietary investigation topics, and the skill’s workflow explicitly transmits them to third-party services during repeated searches.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: 文件标题和全文内容均以中文呈现，且未说明这是特定中文区域场景的限定文档，也没有为用户提供语言选择或 opt-in。根据规则，强制特定语言而无选择机制可构成自然语言政策违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill is named and described as a China/domestic social-media research tool and frames operation entirely around '国内' platforms and context, but it does not tell users this locale restriction is optional or solicit user preference. That can create a language/locale policy issue if the broader environment expects user choice unless the regional constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.