T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/price.py:68- Finding
Environment-Derived Identifier Transmitted to Third-Party APIs
- Content
View full analysis
- Remediation
View remediation
Security audit
淘宝/京东/拼多多/全网商品检索比价
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its shopping-search purpose, but it quietly sends persistent identifiers and an invitation code to a third-party shopping API when searching or generating links.
Review before installing. This skill does not show local persistence or destructive behavior, but it sends shopping queries and stable identifiers to maishou88.com and may generate attributed share/referral links. Use only if you accept that data sharing and link-attribution behavior, and prefer a version that removes hardcoded identifiers or clearly discloses them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
scripts/price.py:219- Finding
Undisclosed Persistent Tracking and Affiliate Attribution in Generated Purchase Links
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to execute a local Python script that makes outbound network requests, but the manifest does not declare any tool scope or permission boundaries. This creates an implicit capability escalation risk: the skill can cause code execution and network access without clear least-privilege constraints or user/operator visibility.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These Chinese triggers are very broad phrases used in ordinary shopping conversations, so the skill may activate unintentionally for generic requests. Unintended invocation can cause unnecessary product searches, external requests, and agent behavior that overrides a more appropriate built-in or safer workflow.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 89% confidence
- Finding
The trigger 'find cheapest' overlaps with a common built-in command pattern centered on 'find', which can shadow or hijack normal assistant behavior. In practice, this may cause a generic user request to be routed into this skill unexpectedly, leading to unintended external searches and purchase-link generation.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 90% confidence
- Finding
The trigger 'search product' conflicts with common assistant and built-in search semantics, creating a command-shadowing risk. Because this skill is designed to perform external lookups, an invocation collision can unexpectedly send user queries into a third-party shopping flow rather than a general search workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The English triggers such as 'best deal', 'price check', and 'search product' are generic and likely to appear in normal conversation or other assistants' workflows. This increases accidental invocation risk and may route unrelated user intents into a network-enabled shopping skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script embeds default OPENID and INVITE_CODE values and automatically transmits them to third-party APIs. These values appear to function as account or affiliate identifiers, enabling tracking or monetized link generation without requiring explicit operator configuration or user awareness. In a price-comparison skill, silently falling back to built-in identifiers is risky because it can route user actions through someone else's account context and create undisclosed attribution or abuse of embedded credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Credential-like defaults are embedded in code and used automatically without clear notice or consent. Even if these are not traditional secrets, they act as persistent identifiers tied to an external service and can expose the operator to misuse, credential harvesting, attribution hijacking, or undisclosed tracking when the script is reused. The danger is higher because the values are silently sent on every request.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The search request sends the user's keyword along with a bundle of system-identifying headers, including device/model-style metadata and the openid, to an external domain without explicit disclosure in the tool behavior. This creates a privacy and transparency issue: user shopping queries and stable identifiers are exfiltrated to a third party, potentially enabling profiling or tracking beyond what a user would expect from a simple comparison tool.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest promises cross-platform smart filtering, recommendation ranking, cheapest/best-deal discovery, coupon finding, and preferred-product recommendation. In code, the search path only fetches pages, optionally sorts by actualPrice, and prints raw fields; the link path simply retrieves a target URL and token. No recommendation logic, deal analysis, coupon search workflow, or ranking beyond a basic price sort is implemented.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The link-generation flow sends goodsId, sourceType, and inviteCode to an external service and returns purchase links and promotional codes without making the affiliate or attribution behavior explicit. In this skill context, that is more dangerous because users expect impartial price comparison, but the generated links may be monetized or tracked through an embedded invite code, creating an undisclosed conflict of interest and privacy concern.
- Content
Overly Broad Trigger
Low
- Category
- Trigger Abuse
- Confidence
- 91% confidence
- Finding
The trigger '比价' is extremely short and highly ambiguous, making accidental matching likely in normal conversation. Even if impact is limited to shopping searches, it still increases the chance of unintended network activity and confusing agent behavior.
- Content
Static analysis
No suspicious patterns detected.