Xiaozhi Recycle Order

• Outcome: Pass
• Latest audit: Sep 18, 2026 · 6:00 AM UTC
• Version: 0.1.2

Overview

This skill is a disclosed Xiaozhi recycling order helper, but it handles personal pickup details, WeChat authorization, external OCR, and real order submission, so users should review those flows carefully.

Install only if you are comfortable sending your name, phone number, pickup address, order details, and optional device photos or image URLs to Xiaozhi/Bearhome services. Confirm the order summary, OCR results, and clothing price before scanning WeChat authorization, because the documented flow submits the order automatically after authorization. Remove temporary QR/HTML files after use on shared machines.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The skill behavior is broader and materially different from its declared purpose: it includes WeChat authorization, QR/HTML generation, token polling, and price-query flows, while the OCR support appears inconsistently represented. This mismatch can mislead reviewers and users about what data is collected, what external services are contacted, and what actions occur automatically, reducing informed consent and increasing the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

After WeChat authorization succeeds, the script immediately proceeds to submit an order using previously supplied personal and address data, without a final confirmation step immediately before the irreversible network action. In a transactional skill handling real-world pickup orders, this creates a significant risk of unintended orders, user deception, or abuse if parameters were prefilled incorrectly or manipulated upstream.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to write local files and make network requests, but it does not declare any tool scope or allowed-tools constraints. In an agent environment, this weakens least-privilege controls and can allow unintended execution of file and network actions involving user data, authorization flows, or external endpoints without explicit policy review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill processes highly sensitive personal data, including name, mobile number, full address, and potentially uploaded device nameplate images containing serial numbers, then sends them to external services. Without an explicit privacy warning and consent language, users may not understand that their PII and images are transmitted off-platform for OCR, login authorization, quotation, and order creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The authentication flow describes obtaining, polling for, and reusing bearer-like tokens for downstream order creation, but omits any security guidance on token secrecy, storage, expiration handling, or log redaction. Because these tokens authorize actions against an external platform, mishandling can enable account/session takeover or unauthorized order placement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly defines collecting and transmitting personal data such as name, mobile number, and full address to an external service, but provides no privacy notice, consent requirements, retention guidance, or handling restrictions. In a user-facing ordering skill, this omission increases the risk of unauthorized collection, over-sharing, or noncompliant processing of sensitive personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation instructs sending user-supplied device photos or image URLs to a third-party OCR service, but it does not clearly require user notice or consent for external transmission of potentially sensitive data. Nameplate or certificate images can contain serial numbers, product ownership details, and sometimes location-linked or personal information, so silent forwarding creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 22)May include surrounding context.

md

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 57)May include surrounding context.

md

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 136)May include surrounding context.

md

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 181)May include surrounding context.

md

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_order.py (reported line 20)May include surrounding context.

python

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_order.py (reported line 21)May include surrounding context.

python

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_order.py (reported line 22)May include surrounding context.

python

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create_order.py (reported line 23)May include surrounding context.

python

# URL 常量
# ============================================================
DEFAULT_DEVICE_ORDER_URL = "https://papi.bearhome.cn/hs/app/order/open/used"
DEFAULT_POLL_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverComm/auth/getTokenByCode"
DEFAULT_CLOTHING_PRICE_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/queryPrice"
DEFAULT_CLOTHING_ORDER_URL = "https://api.bearhome.cn/hsapi/recovery/order/recoverOrder/createOrder"
DEFAULT_MINIPROGRAM_CODE_URL = "https://api.bearhome.cn/api/product/product/fuwu/codePic"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code downloads authentication artifacts and writes them to local temporary files without explicit user notice or consent, creating undisclosed filesystem side effects. These files may persist longer than expected and can expose login-related content or sensitive workflow artifacts to other local users or processes, especially on shared systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script starts a localhost HTTP server solely to receive cancellation requests from generated HTML, which increases the attack surface on the local machine beyond what is necessary for order submission. Although bound to 127.0.0.1, any local process or browser context able to reach that predictable port can trigger cancellation, and the hidden side effect is not clearly disclosed to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated HTML embeds authentication content and contains JavaScript that calls back into a localhost cancellation endpoint, yet the user is not clearly informed that opening the page will involve local browser-to-localhost requests. This hidden behavior can surprise users, complicate security review, and create a local interaction surface that other software may abuse or interfere with.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/create_order.py (reported line 612)May include surrounding context.

python

var msg = document.getElementById('cancelMsg');
  btn.disabled = true;
  btn.textContent = '正在取消...';
  fetch('http://127.0.0.1:' + cancelPort + '/cancel')
    .then(function(r) { return r.json(); })
    .then(function(data) {
      if (data.cancelled) {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes this skill as being used to create recycle orders, with custom device/clothing details and OCR-assisted ordering. This file also implements and exposes a separate '--query-price-only' mode that performs clothing valuation without creating an order, which is a user-visible behavior not reflected in the manifest's stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends either a local image or an arbitrary image URL to a third-party OCR endpoint, and those images may contain sensitive personal or device-identifying data such as serial numbers, certificates, or location-linked ownership details. Because the transfer happens automatically and the tool returns/handles extracted data without an explicit privacy warning or consent gate, users may unknowingly disclose sensitive information to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file's user-facing strings, help text, and generated HTML are entirely in Chinese, with no indication that the user can opt into another language. This can violate language/locale policy when a skill enforces a single language without user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language interface text, usage description, CLI argument help, and success/error messages are all Chinese-only. This can constitute a language policy issue when the skill forces a specific language without giving users a choice or documenting the locale restriction.

Content

No source excerpt is available for this finding.