Security audit

Cid Tracking

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it handles ad-platform credentials and conversion data with weak safeguards and has a real Excel report injection risk.

Review before installing in a production ad account. Use least-privilege API tokens, keep config.json out of source control, restrict file permissions, avoid sending personal identifiers unless legally authorized, and treat generated Excel files as potentially unsafe until formula escaping is added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/report_generator.py:216
Finding: Spreadsheet Formula Injection Through Untrusted Advertising Data
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Third-Party Dependency Versions
Content: View full analysis
=3.0.0 pandas>=1.3.0 requests>=2.25.0 matplotlib>=3.4.0 python-dateutil>=2.8.0 ``` ### Technical Analysis Every dependency uses only a minimum-version constraint. No exact versions, upper bounds, lock file, or package hashes are provided. Consequently, the documented installation command can install dependency versions that were never reviewed as part of this Skill audit. This does not establish that any listed package is currently malicious. The risk arises because installation is mutable over time and depends on the configured Python package index. A future compromised release, malicious mirror, dependency-confusion condition, or incompatible update could introduce unexpected code into the Skill environment. Python packages and their transitive dependencies execute with the permissions of the user or environment in which the Skill is installed and run. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` procedure. 2. Pip resolves the newest versions satisfying the broad minimum-version constraints. 3. A configured index or dependency release supplies a malicious or compromised version, or a future incompatible version is selected. 4. The package is installed into the Skill's Python environment. 5. Package code executes when imported or used by the Skill. 6. The compromised dependency obtains the same filesystem, process, and network permissions as the Skill process. ### Impact Assessment A malicious dependency could execute arbitrary Python code with the privileges of the installing or runtime user. Potential impact includes reading local Skill configuration, accessing API credentials, modifying generated reports, making unauthorized network requests, or altering files accessible to the process. The pra ...[truncated 224 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: config.example.json:1
Finding: Advertising API Credentials Stored in an Unprotected Plaintext Configuration File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (34)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/oceanengine_api.md (reported line 5)May include surrounding context.
认证方式

Access Token

http
Access-Token: YOUR_ACCESS_TOKEN

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The quickstart instructs users to create and populate a config.json file with access tokens and secret keys, but it does not warn that these values are sensitive secrets that must not be committed, shared, or stored insecurely. In a skill centered on multi-platform ad APIs, this omission can lead to credential leakage, unauthorized API access, billing abuse, and exposure of business data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented automation workflow fetches ad-platform data and sends conversion/order information to external platforms, but it does not warn users that these actions transmit potentially sensitive business and user-related data outside their environment. In this context, the skill is specifically designed to automate cross-platform marketing telemetry, so missing privacy/compliance notice increases the risk of accidental data sharing, policy violations, or misuse of production data during setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to transmit conversion and order-related data to third-party ad platforms, but it does not warn about privacy, consent, data minimization, or applicable compliance obligations. In an ad-tracking context, this omission can lead operators to share personal or commercially sensitive data improperly, creating real privacy and regulatory risk even if the document does not explicitly mandate sending PII.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly supports sending order and conversion data back to external advertising platforms, but it does not disclose what data may be shared, whether that data could include personal or transactional information, or what consent/compliance requirements apply. In an ad-tracking context, this omission increases the risk of privacy violations, unintended data disclosure, and noncompliant handling of user purchase data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup section tells users to place access tokens and secret keys in a local config file, but provides no guidance on secure storage, rotation, exclusion from version control, or least-privilege credential management. This can lead to accidental credential exposure through repositories, logs, shared files, or backups, enabling unauthorized access to ad accounts and related data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document recommends passing a CID together with device identifiers such as IMEI in URL parameters, which can expose persistent identifiers through browser history, server logs, referrer headers, analytics tools, and third-party infrastructure. Although the file later mentions privacy compliance in general terms, it does not provide a clear user-facing warning at the point of collection or safer handling guidance for these identifiers, making this a genuine privacy and data-handling weakness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file presents all instructional content, field explanations, and operational descriptions exclusively in Chinese, with no indication that language selection is optional or that the skill is intentionally region- or locale-specific. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document provides a conversion callback example that sends user and order-related data such as cid, order_id, purchase value, and timestamp to a third-party advertising endpoint without any privacy, consent, minimization, or data-handling warning. In a skill/reference context, this can normalize unsafe telemetry integration and lead developers to transmit sensitive business or user-linked data without validating legal, contractual, or security requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains natural-language descriptions, help text, and runtime messages exclusively in Chinese, starting from the module docstring and continuing throughout CLI output. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description, CLI help text, status messages, and errors are written entirely in Chinese, which effectively fixes the user-facing locale. The file does not offer a language option or explain that the tool is intentionally limited to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code posts conversion payloads to an external advertising platform, and the payload may include hashed user identifiers such as user_id and phone_num. While comments describe the mechanics, there is no confirmation prompt or explicit user-facing disclosure at the point of transmission that user/order data will be sent to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This branch sends conversion data including cid, event_type, value, and optionally order_id to Kuaishou over HTTP. The file prints a generic 'sending conversion data' message in main, but it does not explicitly warn that user or business data is being transmitted to a third-party ad network.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The class docstring at L185 describes this component as a '腾讯广点通转化回传器', and the track method docstring at L200 says it '回传广点通转化'. However, the actual code at L201-L207 only prints a warning and returns a hardcoded '待实现' failure response without contacting Tencent at all.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language content such as the module docstring and multiple CLI help/messages that assume Chinese as the only operating language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/kuaishou_api.md (reported line 16)May include surrounding context.
md
class KuaishouFetcher(DataFetcher): """快手磁力引擎数据获取器""" BASE_URL = "https://api.kuaishou.com/openapi/ad" def __init__(self, config: Dict): super().__init__(config)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/kuaishou_api.md (reported line 53)May include surrounding context.
md
class KuaishouFetcher(DataFetcher): """快手磁力引擎数据获取器""" BASE_URL = "https://api.kuaishou.com/openapi/ad" def __init__(self, config: Dict): super().__init__(config)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/conversion_tracker.py (reported line 130)May include surrounding context.
python
class KuaishouFetcher(DataFetcher): """快手磁力引擎数据获取器""" BASE_URL = "https://api.kuaishou.com/openapi/ad" def __init__(self, config: Dict): super().__init__(config)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/data_fetcher.py (reported line 118)May include surrounding context.
python
class KuaishouFetcher(DataFetcher): """快手磁力引擎数据获取器""" BASE_URL = "https://api.kuaishou.com/openapi/ad" def __init__(self, config: Dict): super().__init__(config)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The argument parser and analyzer construction suggest that --gmv-multiplier changes GMV/ROI estimation, since the value is passed into ROIAnalyzer({'gmv_multiplier': args.gmv_multiplier}). However, ROIAnalyzer.__init__ never reads config['gmv_multiplier'] and instead hardcodes self.default_gmv_multiplier = 1.0, so the documented/configured behavior contradicts the actual implementation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: 整个技能快速开始文档均以中文呈现，未说明该技能是否仅面向中文用户，也未提供其他语言选项或用户选择机制。按照语言/区域策略，若技能强制特定语言而无用户选择或明确业务限定，可能构成自然语言层面的政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All user-facing instructions, headings, and examples are presented only in Chinese, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: All headings, descriptions, and examples are presented only in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The file does not indicate that the skill or reference is intentionally restricted to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file presents all instructions and examples exclusively in Chinese, and it does not indicate that the skill is region-specific or provide an opt-in language choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified with a lower-bound version only, which allows different builds to resolve to different releases over time. This weakens reproducibility and can unintentionally pull in vulnerable or breaking versions, making supply-chain risk harder to assess and control.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
openpyxl>=3.0.0 pandas>=1.3.0 requests>=2.25.0 matplotlib>=3.4.0

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

认证方式

Access Token

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

External Transmission

Intent-Code Divergence

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Unpinned Dependencies

Static analysis