Security audit

饿了么外卖点餐

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently automates an Ele.me food order in a browser and keeps payment under the user's control, with some expected privacy and dependency cautions.

Before installing, understand that the agent will see and enter Ele.me login and checkout information in the browser, including SMS codes and delivery details. Use a trusted browser context, confirm the address/items/total before order submission, complete payment yourself, and consider pinning the Playwright MCP package version instead of using @latest.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Unpinned Playwright MCP Dependency Allows Execution of Unreviewed Upstream Code
Content: View full analysis
Remediation: View remediation
"] ``` 2. Manage the dependency in a package manifest and lockfile rather than resolving it dynamically whenever the MCP server starts. 3. Commit and review the lockfile, and use a clean installation mechanism such as `npm ci` that honors locked dependency versions and integrity hashes. 4. Configure the package manager to use a trusted registry and preserve package integrity verification. 5. Review release notes and dependency changes before upgrading the pinned version. Perform upgrades through explicit, controlled change requests rather than automatic tag resolution. 6. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, and network access. 7. Avoid exposing unrelated credentials or sensitive local directories to the MCP process. 8. Where operationally feasible, disable package lifecycle scripts during installation and obtain the dependency from an internally approved or verified artifact repository. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to handle sensitive personal data during login and ordering, including phone numbers, SMS verification codes, delivery addresses, recipient names, and phone numbers, but the description does not warn users about this data handling. This can mislead users about the privacy and security implications of using the skill and increases the risk of accidental disclosure of authentication data and personally identifiable information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.