蛋糕叔叔商城点单助手

• Outcome: Review
• Latest audit: May 28, 2026 · 6:11 AM UTC
• Version: 1.0.0

Overview

This cake-ordering skill matches its stated purpose, but it handles account tokens and delivery details with broad local command authority and plaintext local storage.

Review before installing. Only use it if you are comfortable giving this skill your dangaoss.com token and delivery details. Treat dgss_token.md as sensitive, avoid committing or syncing it, clear it when done, and require approval before any local command or account-changing action runs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The description claims '完全使用curl请求，无需MCP代理', yet the documented endpoint is an MCP-style server and the skill also supports order-status queries not disclosed in the summary. Misrepresenting behavior weakens informed consent and trust boundaries, making users and reviewers less likely to scrutinize remote data handling and additional capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs persistent local storage of `user_token` plus address and order metadata in markdown files. Persisting bearer-like authentication material and personal data in plaintext broadens exposure to local compromise, accidental sharing, backup leakage, and cross-user misuse on shared systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a narrowly scoped cake-ordering assistant, but the only exposed tool is a generic command-execution interface that accepts an arbitrary command string. That creates a large trust boundary violation: an agent or prompt path that is supposed to perform shopping actions can instead run unrestricted local shell commands, enabling command injection, file access, credential theft, or arbitrary code execution on the host.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Very broad trigger keywords like '蛋糕', '下单', or '订购' can cause unintended activation in ordinary conversation. In this skill, accidental triggering is more dangerous because the workflow accesses local files, prompts for tokens, and can initiate order-related operations tied to stored credentials and addresses.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill directs storage of the user's token locally without clearly informing the user that it will be persisted and reused later. Because the token appears sufficient to act on the user's shopping account, undisclosed persistence creates a meaningful privacy and account-abuse risk if the host or workspace is later accessed by others.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs transmitting a user token together with personally identifiable information such as recipient name, phone number, and full delivery address to an external service, but provides no privacy notice, consent guidance, retention limits, or data-handling safeguards. In an agent skill context, this increases the chance that highly sensitive user data is sent to a third party without informed user approval or adequate minimization.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends `user_token` and other user-provided data to an external service endpoint without any in-script disclosure, consent flow, or minimization. In an agent skill context, this is more sensitive because the skill may invisibly exfiltrate account tokens, addresses, search terms, and order-related data to a third-party backend whenever invoked.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `add_addr` path performs a state-changing remote action that can add or alter shipping address data on behalf of the user, yet the script includes no confirmation or guardrail before issuing the request. In a commerce agent skill, this increases the risk of unauthorized account modification, accidental orders to the wrong address, or abuse if a token is exposed.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The tool description is broad and operationally vague, describing script execution for an MCP server interface without clear constraints on when the tool may be invoked or what exact commands are permissible. In the context of an agent skill, this ambiguity increases the chance of unsafe or overbroad invocation, especially because the parameter is a free-form command string rather than a constrained action schema.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly stores and reuses user tokens and personal address/order data in local markdown files. This is dangerous because plaintext local persistence of credentials and PII enables account takeover, privacy leakage, and unauthorized reordering if another process, user, or backup system can read those files.

Ssd 3

Medium

• Confidence: 85% confidence
• Finding: The skill instructs returning full recipient contact and address details from stored/order data. Even when shown back to the same user, this increases exposure of PII in chat logs, screenshots, logs, and shared-session contexts; the risk is heightened because the skill also caches these details for reuse.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The defined memory schema stores a bearer token, default address linkage, and order history for future reuse, creating a durable local profile of a user's account and purchasing activity. In the context of an agent skill with shell/file access, such cached data materially increases the blast radius of any local compromise or accidental disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `user_token` | string | 是 | 用户 token |
| `city_name` | string | 是 | 城市名（规范到市一级，如"深圳市"） |

**curl 示例**：
```bash
curl -s -X POST "https://www.dangaoss.com/dsapi/workbuddy/mcp_server" \
  -H "Content-Type: application/json" \

• Confidence: 89% confidence
• Finding: This example shows external transmission of a user_token and city_name to a third-party endpoint. External transmission is expected for an ordering skill, but in this context it still represents a real data-exposure risk because the skill handles authenticated user context and sends it off-platform without any documented consent, token protection, or logging restrictions.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `name` | string | 是 | 收货人姓名 |
| `phone` | string | 是 | 11位手机号（1[3-9]开头） |

**curl 示例**：
```bash
curl -s -X POST "https://www.dangaoss.com/dsapi/workbuddy/mcp_server" \
  -H "Content-Type: application/json" \

• Confidence: 96% confidence
• Finding: This example transmits especially sensitive personal data—user_token, recipient name, phone number, and detailed address—to an external service. In an agent skill, that materially raises privacy and misuse risk because it enables collection of enough information for identity, location, and delivery profiling, yet the documentation contains no warning, consent flow, or data-protection requirements.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `spec_id` | string/int | 是 | 商品规格 ID |
| `city_name` | string | 是 | 城市名（规范到市一级） |

**curl 示例**：
```bash
curl -s -X POST "https://www.dangaoss.com/dsapi/workbuddy/mcp_server" \
  -H "Content-Type: application/json" \

• Confidence: 84% confidence
• Finding: This example sends authenticated order-generation data, including user_token, address ID, product spec_id, and city_name, to a remote endpoint that returns a live ordering URL. In the skill context, this is sensitive because it can create actionable purchase links tied to a user's account and address context, but the documentation does not mention user confirmation, anti-abuse controls, or safe handling of the returned link.

Static analysis

No suspicious patterns detected.