Security audit

新帆线索池运营

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for internal lead management, but its daily report can present fabricated business metrics as real operational data.

Review this skill before installing. It can act on real lead records through your logged-in browser session and can change lead state after confirmation. Do not enable the private daily report unless the mock KPI section is removed, replaced with real metrics, or clearly labeled as demo data.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares no explicit permissions while instructing the agent to use environment variables, browser/CDP access, and networked backend calls. This weakens permission transparency and reviewability, making it easier for a user or platform to underestimate the skill’s real access to authenticated internal data and state-changing operations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose understates several sensitive behaviors: use of a logged-in browser session to act as the user, optional token storage, retrieval of plaintext contact data, and possible automatic follow-status advancement when viewing details. Hidden or under-disclosed side effects are dangerous because an agent may trigger privacy-sensitive reads or irreversible business-state changes under the user’s identity without informed consent.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The code explicitly documents that the daily report intentionally uses fabricated business metrics instead of real lead statistics. In an operations/reporting skill, presenting invented KPIs as if they were genuine can mislead users into making business decisions on false data, which is an integrity failure rather than a mere placeholder issue.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The implementation hard-codes conversion statistics through CONVERSION_MOCK and uses them to build the '今日战报' section, so users receive fictitious performance data. Because this skill is for lead-pool operations and scheduled daily pushes, the false metrics can be repeatedly distributed at scale and create sustained business misreporting.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The schema exposes mutating operations such as claim/release of leads without embedding any explicit confirmation or user-consent guidance in the interface contract. In an agentic environment, this increases the chance of unintended state changes from ambiguous prompts, automation mistakes, or prompt injection that tricks the agent into performing business actions the user did not clearly authorize.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/private-daily-report.js:14