Security audit

Yidian Upload

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can make real shop and Feishu changes through an existing logged-in browser session with weak confirmation and hardcoded resource identifiers.

Install only if you intend to let the skill publish real listings and update Feishu records. Use dry-run first, remove hardcoded Feishu identifiers, verify the logged-in Edge account and target shop before each run, and avoid granting access to production accounts until confirmation and rollback controls are added.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill describes substantial code-execution capabilities including local file access, file modification, shell execution, and network/CDP connectivity, yet no explicit permissions are declared or constrained. In an agent environment, this creates an authorization gap where a broadly capable automation skill may perform sensitive actions without clear user-visible scoping or runtime guardrails.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README clearly promotes automation that logs into an external seller backend, publishes listings, and writes status back to Feishu, but it does not prominently warn users that the skill can perform irreversible actions in third-party systems. In an agent/skill context, missing action-scope and side-effect disclosures increases the risk of unintended listings, incorrect inventory/status updates, and misuse by users who assume the tool is only doing local parsing or preview work.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The routing model allows natural phrases like '上架到XX店' to trigger store-specific automation based on remembered shop names, which is broad enough to overlap with ordinary conversation. That can cause unintended invocation of a powerful automation flow affecting listings, pricing, inventory, or delivery settings in the wrong store.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script contains a hardcoded Feishu spreadsheet token and sheet identifier directly in source code. Embedding live service credentials in a distributed skill increases the risk of unauthorized access, accidental disclosure through source sharing or logs, and makes secret rotation difficult if the repository or package is exposed.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: A spreadsheet token is hard-coded in executable test code, which exposes a live credential or resource identifier to anyone with source access and risks accidental leakage through version control, logs, or redistribution. In an agent skill context, embedded secrets are especially dangerous because skills are often shared, reviewed, or run in semi-automated environments where credential exposure can lead to unauthorized data access.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script immediately connects to an existing browser session and performs real product publication and post-publication configuration changes without any final confirmation, dry-run mode, or rollback guard. In this skill’s context, those actions are operationally sensitive and can create unintended listings, enable auto-delivery, and alter shop settings if the wrong values or account context are active.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This code automates live product creation, publishing, and post-publication configuration changes against a production admin interface via Chrome DevTools Protocol, including clicking publish and enabling fulfillment-related switches. Because there is no explicit user confirmation, dry-run mode, environment gating, or rollback protection, a mistaken or malicious invocation can cause unintended irreversible business actions on a real shop account.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to collect store names and configurations on first use and reuse them automatically on future requests. Persistent accumulation of operational business data without clear storage boundaries, minimization, retention rules, or consent can lead to cross-session data leakage or misuse, especially when tied to store operations.

Ssd 3

Medium

Confidence: 90% confidence
Finding: This section directs the AI to gather a comprehensive reusable set of store parameters including pricing, inventory, shipping, city, and automation settings. Centralizing and persistently reusing that operational profile increases the blast radius of prompt mistakes, misrouting, or unauthorized access because one misfire can apply a full business configuration to future actions.

Skill Enumeration

Medium

Category: Agent Snooping
Content: **同步规则：以 WorkBuddy SKILL.md 为中心，单向推送到飞书文档。** - **主源**：WorkBuddy SKILL.md（`~/.workbuddy/skills/yidian-upload/SKILL.md`）— 所有修改都在这里进行，当前版本 **v3.4** - **飞书文档**：作为镜像备份 ## 同步方式
Confidence: 81% confidence
Finding: The document exposes an internal filesystem path to the local skill directory and describes the synchronization topology. While not immediately exploitable on its own, this leaks environment structure that can help an attacker enumerate local resources, craft path-targeted prompts, or infer where mirrored documents and related skills reside.

Unvalidated Output Injection

High

Category: Output Handling
Content: """运行飞书 CLI 命令并返回解析后的 JSON""" cmd = [self.node_path, self.lark_script] + args try: result = subprocess.run( cmd, capture_output=True, timeout=30, encoding='utf-8', errors='replace' )
Confidence: 95% confidence
Finding: Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

No suspicious patterns detected.