Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/fetch.js
Security audit
OpenRouter Rankings Tracker
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward OpenRouter rankings scraper with disclosed optional local saving, though its Feishu push documentation is under-specified and appears unimplemented in the bundled script.
Before installing, understand that the script opens OpenRouter in Playwright and may save reports under your home directory when run with `--save`. Do not rely on `--push` unless you separately verify or implement the Feishu integration, and only configure Feishu automation if you intend to send the generated rankings report to that external service.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/fetch.js
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 80% confidence
- Finding
The skill describes executable behavior and references capabilities that may rely on environment access, but it does not declare any explicit tool scope or permission boundaries. This creates ambiguity about what the skill is allowed to access and can lead to over-privileged execution in hosts that infer capabilities loosely, especially for scheduled or automated runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents an automated weekly workflow that can push fetched data to Feishu without any explicit warning that information will be transmitted to an external service. Even if the payload is intended to be rankings data, silent outbound transmission in an automated context reduces user awareness and increases the risk of unintended data sharing or misuse of configured credentials.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest description limits the skill to fetching and tracking OpenRouter rankings and generating weekly reports. However, the skill documentation also advertises a
--pushoption and cron payload to 'push to Feishu', which is an outbound notification/integration capability outside the described rankings-focused scope.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The report date is formatted with
toLocaleDateString('zh-CN'), which hard-codes a specific locale in user-facing output. This is a natural-language/locale policy concern because the script does not offer a language or locale choice or document why Chinese formatting is required.- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
For a rankings-fetching skill, using Playwright to load a web page is justified, but embedding a specific local path such as '/home/Admin/.cache/...' is not inherent to the skill's stated purpose. This introduces environment-specific filesystem dependency unrelated to the user-facing intent of fetching OpenRouter rankings.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The manifest emphasizes fetching, tracking, and producing weekly reports about OpenRouter rankings. This code also persists data and markdown reports under the user's home directory, which is a broader behavior than simple on-demand fetching, though still related to tracking.
- Content
Static analysis
No suspicious patterns detected.