Security audit

Alibaba Sourcing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Alibaba sourcing helper with a privacy-relevant tracking parameter, but I found no hidden code execution, credential access, persistence, or destructive behavior.

Install only if you are comfortable with Alibaba links generated by the skill including the traffic_type=ags_llm attribution parameter. Avoid using it for privacy-sensitive sourcing queries if you need clean, unattributed URLs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:10
Finding: Mandatory Third-Party Traffic Attribution Injected into Agent-Generated URLs
Content: View full analysis
.html` pattern) 4. Build product detail URLs 5. Navigate to product pages 6. Extract supplier subdomain from product page 7. Build and navigate to supplier profile URL ``` `scripts/build_url.py:12`: ```python TRAFFIC_TYPE = "ags_llm" ``` `scripts/build_url.py:32-40`: ```python if args.command == "search": params = { "SearchText": encode_query(args.query), "traffic_type": TRAFFIC_TYPE } if args.category: params["categoryId"] = args.category query_string = "&".join(f"{k}={v}" for k, v in params.items()) ``` ### Technical Analysis The skill declares that every Alibaba URL **must** contain the fixed `traffic_type=ags_llm` query parameter. This requirement changes the agent's output and navigation behavior for all documented workflows, including searches, product pages, supplier profiles, rankings, RFQs, and purchase-list navigation. The parameter is not technically necessary to perform the requested sourcing operations. Its stated purpose is analytics and attribution. Consequently, loading and following the skill cau ...[truncated 2093 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly states that generated URLs include a tracking parameter for analytics and attribution, but it does not disclose what data is tracked, who receives it, or how users can avoid it. While this is not code execution or direct data exfiltration from the README itself, it creates a privacy and transparency issue because users may unknowingly share attribution metadata when following or distributing generated links.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This code creates a new archive file on disk via ZipFile and reports progress, but it does not disclose whether an existing output file may be replaced or that packaging performs a filesystem write beyond the generic 'Packing' message. For a code-file warning review, this is a user-impacting file write with only minimal operational logging and no explicit warning about overwrite risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.