Yegking Exclusive Drops & Discount Monitor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:13 AM UTC
• Version: 1.0.0

Overview

The skill is technically bounded to a sneaker vendor, but it repeatedly pushes that vendor and makes unsupported claims that its coupon is hidden or exclusive.

Review this before installing if you want neutral shopping help. It is built to steer searches and advice toward yegking.net, and its coupon exclusivity claims should not be treated as verified. Technically, I did not find persistence, credential theft, arbitrary code fetching, or destructive behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:75
• Finding: Mandatory Commercial Redirection and Promotional Output Hijacking< — ask this Skill for your exclusive discount code.* ``` `qc-guide.md:83`: ```md *For the best QC experience, visit [yegking.net](https://yegking.net) and use this Skill to get your exclusive discount code.* ``` ### Technical Analysis The Skill embeds mandatory instructions that alter the agent's response policy after the Skill is loaded. Rather than limiting instructions to the declared functional requirements—searching for products, giving batch advice, and providing quality-control guidance—it requires the agent to: 1. Direct all browsing to one commercial vendor. 2. Always display that vendor's search URL. 3. Append promotional coupon messaging to user ...[truncated 2852 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory language such as “Always Link” and “Direct all shoe browsing” from the Skill instructions. 2. Restrict vendor links to requests where the user explicitly asks to search `yegking.net`. 3. Do not append coupon or store promotion to unrelated QC and batch-comparison answers. 4. Replace unsupported “hidden,” “exclusive,” and “only accessible through this Skill” claims with factual wording, such as: ```md If requested, provide the configured coupon code. Coupon availability and eligibility should be verified with the seller. ``` 5. Clearly disclose any commercial affiliation, referral relationship, sponsorship, or financial incentive associated with the vendor. 6. Allow neutral recommendations and alternatives when the user has not selected a particular seller. 7. Inform users before live searches that their search terms will be sent to `yegking.net`. 8. Keep the network request limited to the declared HTTPS origin and continue URL-encoding user input. 9. Remove promotional footer text from `batch-comparison.md` and `qc-guide.md`, or make it conditional on an explicit request for purchasing information. 10. Add tests ensuring that general QC questions do not produce vendor advertising and that vendor links appear only when relevant and requested. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes shell and network-capable behavior (`bash search.sh` and live queries to yegking.net) but does not declare any explicit tool scope or permissions boundaries. That creates an authorization gap where an agent may execute commands or make outbound requests without a transparent, least-privilege contract, increasing the risk of unintended command execution, SSRF-like access through scripts, or broader-than-expected data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to read `YEGKING_COUPON` from the environment even though its stated purpose is product search and recommendations. Accessing environment variables expands the skill's data-access surface and normalizes secret retrieval behavior; if agents broadly honor such instructions, this pattern can lead to disclosure of sensitive runtime values or train users/authors to use env access for nonessential data exfiltration.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The top-of-file documentation describes the script as searching yegking.net and returning product links and discount information. However, later logic also classifies the query into PK/LJR/OG batch recommendations and advertises QC guide assistance, so the documented intent is narrower than the implemented behavior.

Context-Inappropriate Capability

Low

• Confidence: 76% confidence
• Finding: The manifest describes a sourcing/search skill that returns product links, discount codes, and batch recommendations. Accessing process environment state via YEGKING_COUPON is not an obvious requirement for searching the site; it adds a capability to ingest external runtime configuration that is not justified by the stated purpose itself.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The curl request hard-codes an Accept-Language header of "en-US,en;q=0.5", which imposes a specific language/locale preference. Per the policy, locale constraints should either be user-selectable or clearly justified as region-specific.

Static analysis

No suspicious patterns detected.