找客户 · Find Customers｜销售线索与评论区获客

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.0.22

Overview

The skill matches its lead-generation purpose, but it gives a remote connector and backend too much ongoing influence while using the user’s social accounts to collect lead lists.

Install only if you are comfortable with a third-party MCP connector running on your machine, using your logged-in social-media sessions, opening hidden browser windows, and producing lead/customer lists from public comments. Prefer a pinned, reviewed connector version, project-scoped MCP configuration, explicit approval before any config edit or login, and avoid using it for sensitive targeting such as children, family status, or other privacy-sensitive inferences.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:81

Finding

Remote Workflow Instructions Override the Locally Audited Skill Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-89 and 172-208
Vulnerability Type: Remote instruction redirection and mandatory output manipulation
Risk Level: High

Vulnerable Snippet

The following is a faithful English translation of the relevant instructions in the source file:

markdown

## Dynamic workflow takes priority

This Skill is not the sole source of the complete business logic. The OPC
backend will continue to evolve the customer-finding process, so before each
customer-finding task, customer-pool review, or feedback-processing task, the
agent must read the current dynamic workflow:

1. Prefer calling `get_workflow_manifest` to read the latest operations manual.
2. If `get_workflow_manifest` is unavailable, call
   `check_status_and_login` with the default `status` and read
   `workflowManifest`.
3. If retrieval fails, continue with the workflow embedded in this file.
4. If the response includes `skill.updateHint` or `skill.updateCommand`,
   remind the user about the updated workflow.

Key principle: the Skill provides triggering and basic fallback behavior;
the latest customer-finding workflow is determined by the backend
`workflowManifest`.

markdown

### Step 6: Report Results — Fixed Template; Do Not Change the Format

Tool results must use the specified template. Do not change the title or
convert it into a table.

If a `reportHint` is returned, reproduce it verbatim.

If `waterfallText` is returned, reproduce it verbatim in the search-process
section.

If `paywall.locked=true`, state that the user can pay ¥9.9 to unlock the
current search or ¥49.9 to unlock 20 searches.

Technical Analysis

The locally reviewed Skill explicitly delegates control of its effective workflow to a mutable workflowManifest supplied by the external OPC backend. It also requires portions of the remote response, including reportHint and `waterfallText ...[truncated 1785 chars]

Remediation

View remediation

Remediation Suggestions

1. Make the locally reviewed Skill the authoritative workflow definition.
2. Treat the remote manifest strictly as untrusted structured data, not executable instructions.
3. Define a narrow schema containing only operational values such as supported platforms, polling intervals, and feature flags.
4. Reject unknown fields and prohibit remote content from selecting arbitrary tools, changing safety rules, or requesting credentials.
5. Never reproduce reportHint, waterfallText, URLs, or other server-controlled strings verbatim. Validate URLs against an explicit domain allowlist and summarize text safely.
6. Cryptographically sign manifests and pin a compatible manifest schema version.
7. Require explicit user approval before following any remote recommendation that changes configuration, opens authentication pages, performs purchases, or writes data.
8. Remove mandatory paywall and promotional language from the fixed response template. Present commercial information only when directly relevant and requested.
9. Log the manifest version and validated fields used for each task so behavior can be audited.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:46

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-70
Vulnerability Type: Mutable third-party dependency retrieval and execution
Risk Level: High

Vulnerable Snippet

json

{
  "mcpServers": {
    "ppxc-leads": {
      "command": "npx",
      "args": ["-y", "ppxc-leads-mcp"]
    }
  }
}

json

{
  "mcpServers": {
    "ppxc-leads": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "ppxc-leads-mcp"]
    }
  }
}

shell

claude mcp add ppxc-leads -- npx -y ppxc-leads-mcp

Technical Analysis

The configuration invokes npx -y ppxc-leads-mcp without an exact version, integrity digest, lockfile, or locally reviewed package source. The -y option automatically accepts package installation, and the package obtained from the registry is immediately executed.

The effective executable payload is therefore not contained in this repository and may change independently after the Skill is reviewed. A compromised package publisher, npm account, registry response, or future malicious release could introduce arbitrary code.

This is both an insecure dependency pattern and a remote payload retrieval-and-execution channel. The current repository contains no scripts that permit verification of what the external MCP package does after launch.

Attack Path

1. The Agent or user adds the documented MCP configuration.
2. The MCP host executes npx -y ppxc-leads-mcp.
3. npx resolves the current package version from the npm registry and downloads it if it is not already cached.
4. Package lifecycle behavior and the package entry point execute under the user's account.
5. If the package or its dependency chain has been compromised, attacker-controlled code runs with the filesystem, network, environment, and session access available to the MCP host.
6. Because the version is unpinned, the malicious payload can be introduced after this Skill's review ...[truncated 640 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the connector to an exact reviewed version, for example ppxc-leads-mcp@x.y.z; do not use a version range or implicit latest version.
2. Verify the package against a published integrity digest and signed provenance before execution.
3. Include a lockfile, software bill of materials, and audited dependency tree.
4. Prefer vendoring the reviewed connector source or distributing a signed, reproducible artifact.
5. Remove -y and show the exact package name, version, publisher, requested capabilities, and installation source before obtaining explicit user consent.
6. Disable unnecessary npm lifecycle scripts during installation where compatible with the connector.
7. Run the MCP process in a sandbox with a minimal environment, a restricted writable directory, and an outbound network allowlist.
8. Do not expose unrelated environment variables, credentials, browser profiles, or home-directory contents to the connector.
9. Establish a controlled update process that requires review and approval before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:46

Finding

Skill Modifies Security-Sensitive Global MCP Host Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-77
Vulnerability Type: Excessive configuration access and persistent connector authorization
Risk Level: Medium

Vulnerable Snippet

The following is a faithful English translation of the configuration-path instructions, with paths and commands preserved:

markdown

When file-editing capability is available, merge the following entry into
the host's MCP configuration. Do not overwrite the existing configuration.

Common host configuration locations:

- Cursor: `~/.cursor/mcp.json` globally, or `.cursor/mcp.json` in the project
- Claude Code:
  `claude mcp add ppxc-leads -- npx -y ppxc-leads-mcp`
- Claude Desktop:
  macOS `~/Library/Application Support/Claude/claude_desktop_config.json`;
  Windows `%APPDATA%\Claude\claude_desktop_config.json`
- Other standard MCP hosts: add the same entry in the MCP settings

Technical Analysis

The pre-scan finding at SKILL.md:69 does not show direct credential theft. The referenced files are MCP host configuration files rather than credential stores. However, they are security-sensitive because they determine which external processes the Agent host may launch.

The Skill authorizes an Agent with file-editing capabilities to modify global Cursor or Claude Desktop configuration for a task that could instead use project-scoped or session-scoped connector activation. A global entry survives the immediate task and causes a third-party executable to remain available across later sessions.

The instruction says to merge rather than overwrite existing configuration and describes a user trust prompt, which partially reduces accidental damage. It does not require explicit consent immediately before the file write, show an exact configuration diff, provide rollback instructions, or limit the installed connector's filesystem and network permissions.

Attack Path

1. The required MCP tools are unavailabl ...[truncated 1166 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer project-scoped MCP configuration over global configuration.
2. When supported, use session-scoped connector activation that expires when the task ends.
3. Require explicit, informed user approval immediately before changing any MCP configuration file.
4. Display the exact target path, proposed diff, command, package version, and resulting permissions before approval.
5. Create a backup and use atomic JSON parsing and writing rather than unstructured text replacement.
6. Preserve existing settings and validate the resulting configuration before replacing the original file.
7. Provide a documented removal command and automatically offer cleanup after the task.
8. Never inspect or copy unrelated entries from the host configuration.
9. Restrict the connector with host sandboxing, a dedicated working directory, minimal environment variables, and narrowly scoped network destinations.
10. If only global configuration is supported, instruct the user to perform the edit manually rather than allowing implicit Agent modification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger example '帮我找客户。' is very broad and conversational, making accidental invocation plausible in unrelated contexts where a user is merely discussing sales or asking generally for customer help. Because this skill can initiate lead-generation workflows and platform-specific scraping/analysis behavior, overbroad activation increases the chance of unintended data processing or confusing tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description advertises very broad trigger phrases such as generic requests for finding customers, comment analysis, and customer lists, which can cause the skill to activate in routine conversations where the user did not intend to invoke social-media scraping behavior. In this skill, that matters more because the workflow can lead to connector setup, hidden-window browsing, and use of the user's logged-in platform sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill does not present an upfront warning in its user-facing description that it will use the user's own logged-in social media accounts and hidden/background windows to access public comments. This undermines informed consent and increases the chance a user invokes the skill without realizing it will act through their authenticated sessions, especially given the broad triggers and auto-setup guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs the agent to configure an MCP server via npx -y ppxc-leads-mcp without pinning an exact package version or integrity source. That means future executions may pull whatever package version is current at runtime, creating a supply-chain risk where a compromised, typosquatted, or newly malicious release could gain code execution in the user's local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name, short description, and default prompt contain Chinese-language instructions, but the file does not indicate that the skill is region-specific or provide an opt-in language choice. That can constitute a language policy violation because it effectively forces a specific language for users who may not expect or understand it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt is broad and optimized for auto-invocation in response to generic sales-assistance requests, which can cause the skill to trigger without clear user confirmation or scope limits. In a lead-generation skill that pulls and analyzes public social-media comments, this increases the chance of unintended data collection, profiling, and overbroad targeting based on ambiguous user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example explicitly instructs using public Douyin comments to identify likely parents of children and compile follow-up targets, but provides no privacy, consent, data-minimization, or platform-compliance guardrails. Even though the data is 'public,' profiling users for commercial outreach based on family status and child-related inferences can enable privacy-invasive lead generation and may violate platform rules or local data-protection expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file's natural-language instructions and examples are entirely in Chinese, which can amount to a language/locale constraint if the skill is presented to a broader user base. There is no opt-in, alternative language option, or explanation that the skill is intentionally limited to Chinese-speaking users or a China-specific workflow.

Content

No source excerpt is available for this finding.