巴娜淘宝搜索

• Outcome: Review
• Latest audit: Jul 25, 2026 · 7:39 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform Taobao search as described, but it asks for and saves reusable API credentials by default with insufficient permission and storage disclosure.

Review before installing. Only use this skill if you are comfortable giving it Bana Skill Center API credentials, having them sent to wxpub.aibana.art for searches, and having them saved locally for reuse. Prefer opting out of credential saving, avoid setting BANA_TAOBAO_BASE_URL unless you fully trust the endpoint, and remove the saved credentials file when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tainted flow: 'request' from os.environ.get (line 165, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            body = response.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")

• Confidence: 88% confidence
• Finding: The request destination is derived from the environment via BANA_TAOBAO_BASE_URL and then used directly for an outbound POST that includes app_id and secure_key. If an attacker can influence the environment, they can redirect the request to an arbitrary server and capture the credentials, turning this into credential exfiltration rather than ordinary product search.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill directs execution of a Python script, use of saved credentials, optional environment-variable override of the service URL, and network access, but the manifest declares no permissions. This mismatch is dangerous because it hides the skill’s real capabilities from reviewers and users, reducing informed consent and weakening policy enforcement around file, shell, network, and credential-handling behavior.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The skill stores long-lived Bana credentials on disk even though its stated purpose is just Taobao search. Persisting API secrets increases exposure to local compromise, accidental reuse, or later exfiltration without being necessary for a single search operation.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The code reads credentials from disk and environment variables and can also write them back for future reuse, which expands the skill's access to long-lived secrets beyond what a simple search helper strictly needs. That broader secret-handling capability raises the blast radius if the host environment or local files are exposed.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask users for AppID and SecureKey directly in chat and to save them for later use, but it does not provide a clear, upfront warning about persistence, storage location, retention, access controls, or the risks of sharing secrets in conversation. This can lead users to unknowingly disclose long-lived API credentials that may be retained or exposed beyond the immediate session.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: When credentials are supplied on the command line, the code may save them automatically unless --no-save-credentials is set, but it does not give an explicit warning before storing sensitive keys locally. Users may unintentionally leave recoverable long-lived secrets on disk, especially in shared or managed environments.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly tells the agent to solicit user credentials and default to saving them for future queries. Persisting reusable secrets obtained in conversation significantly increases the blast radius of compromise, because any leakage of chat logs, local storage, or the client environment can expose credentials that grant ongoing API access.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This section reinforces a workflow where the agent asks for AppID and SecureKey, passes them on the command line, and saves them by default for future use. Command-line secret passing may expose credentials through process listings, shell history, logs, or debugging output, and default persistence further increases long-term exposure.

Credential Access

High

• Category: Privilege Escalation

Content

return Path(configured).expanduser()
    config_home = os.environ.get("XDG_CONFIG_HOME")
    root = Path(config_home).expanduser() if config_home else Path.home() / ".config"
    return root / "bana-taobao" / "credentials.json"


def load_saved_credentials() -> tuple[str, str]:

• Confidence: 78% confidence
• Finding: The code accesses a fixed credentials.json file under the user's config directory to retrieve long-lived API credentials. While this is intended functionality, it creates a sensitive local secret store that may be exposed through backups, filesystem compromise, or other local access, especially since the skill's purpose does not require durable credential retention.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.