Security audit

ortho-expo-contacts

Security checks for vulnerabilities and agentic risk

Overview

This skill is local and aligned with contact lookup, but it should be reviewed because it stores and searches personal contact data while its access controls, quotas, blocklist controls, and audit claims are weaker than documented.

Use this only in a trusted single-user or tightly controlled local environment. Treat its registration, quota, blocklist, and audit features as workflow reminders rather than strong security controls, and do not enable L3 private data unless you have a clear lawful basis plus separate protections such as filesystem permissions, encryption, and backups. Do not publish or share data/, registry/, or audit/ outputs, and pin dependencies before production use.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/gate.py:155
Finding: Predictable user identifiers are accepted as authentication credentials
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/gate.py:235
Finding: Unlimited self-registration bypasses per-user anti-harvesting quotas
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/gate.py:319
Finding: Blocklist administration is exposed without authentication or authorization
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gate.py:59
Finding: Sensitive registration and contact records are stored in plaintext without enforced permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/gate.py:103
Finding: Unkeyed local audit hash chain can be rewritten and forged
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/query.py:202
Finding: Negative query limits bypass the documented per-request result cap
Content: View full analysis
'' THEN 0 ELSE 1 END), company LIMIT ?" args.append(a.limit) return sql, args ``` ```python ap.add_argument("--limit", type=int, default=20) ap.add_argument("--reveal", action="store_true") a = ap.parse_args() if not os.path.exists(DB_PATH): print(" [x] 索引尚未构建，请先运行：python build_index.py") return 1 if a.limit > MAX_LIMIT: print(f" [x] 单次最多返回 {MAX_LIMIT} 条。这是刻意的限制：本工具不支持批量导出。") return 1 ``` ### Technical Analysis Validation rejects only limits greater than 20. It does not reject zero or negative values. SQLite interprets `LIMIT -1` as no limit, so the SQL query can return every row matching the supplied filters. The subsequent quota check may reject a result set whose cost exceeds the account's remaining quota. Nevertheless, an L1 account with 30 available points can retrieve up to 30 masked results in one invocation, exceeding the documented maximum of 20. Account rotation further compounds the issue. ### Attack Path 1. Create or impersonate an account with unused L1 quota. 2. Select filters expected to match between 21 and 30 records. 3. Run: ```bash python scripts/query.py --user U001 --tier L1 --limit -1 --country Germany ``` 4. SQLite treats `-1` as unlimited. 5. If the total cost is within the remaining quota, more than 20 records are returned in one request. 6. Repeat with additional self-registered accounts and filters. ### Impact Assessment The per-request anti-bulk control can be bypassed. The daily quota still constrains an individual identity, but unrestricted account creation makes that secondary control unreliable. ]]>
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/build_index.py:501
Finding: Third-party dependency installation is not version- or hash-pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill is positioned as a compliance-first contact lookup system with strong safeguards, yet the finding indicates those controls are not actually implemented while the system can still ingest and index sensitive attendee/contact data, including optional L3 private contacts. That mismatch is dangerous because users and reviewers may rely on nonexistent protections, leading to unauthorized access, privacy violations, bulk outreach misuse, and storage of personal data without the promised gating or auditability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction '品牌署名统一用「注册老炮」' is a natural-language policy constraint that forces a specific naming/locale choice. The file does not present this as optional, user-selectable, or justified as a region-specific compliance requirement, so it fits the language/locale policy-violation category.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises local data handling, registration, auditing, and index-building workflows, but it does not declare any explicit tool scope or permissions despite requiring environment access plus file read/write behavior. In an agent environment, undeclared capabilities weaken least-privilege controls and make sensitive operations on contact databases, registries, and audit files harder to constrain or review.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script is explicitly designed to ingest L3 private customer and supplier records containing phone numbers and WhatsApp details, then store them in a local searchable SQLite database when a flag is used. In the context of a skill marketed as an exhibition-directory compliance query tool, this materially expands data sensitivity and creates a straightforward path to aggregate and search private contact data beyond the expected public/restricted directory scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The --include-l3 flag enables indexing of private personal data into an unencrypted local SQLite database with only a brief help-string warning and no interactive confirmation, authorization check, or policy enforcement. That makes accidental or casual inclusion of sensitive contact information easy, after which the data becomes centrally searchable and more exposed to misuse or exfiltration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring, usage examples, prompts, and help text are entirely in Chinese, which imposes a single language for user interaction. There is no indication that the skill is region-specific or that users can opt into another language, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The whoami command prints a registered user's full name, company, title, and contact information for any supplied --user value, with no authentication or authorization check beyond knowing the user ID. In a skill handling expo contact data and complaint/audit workflows, this turns the gatekeeper into a directory of registrants' personal data, enabling internal privacy leakage, user enumeration, and misuse of contact details unrelated to the intended query-gating function.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring, CLI help text, and all user-facing descriptions are written exclusively in Chinese, which effectively fixes the interaction language for users of the skill. The file does not offer any user opt-in or alternative locale, and no region-specific compliance justification is stated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This manifest includes the natural-language value "注册老炮" for the author field, but the file provides no indication that a Chinese locale is required or that multilingual metadata is intentionally supported. Under the policy rule for language/locale constraints, embedding a specific language context without documented opt-in or justification can be a policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: 该文件全文使用中文撰写，包括关键操作说明与风险分级说明，但没有说明这是面向中文用户的限定场景，也没有提供其他语言选项。按照语言/locale 政策，若技能内容强制单一语言而无用户选择或合理限定，可构成自然语言层面的策略问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script's documentation, CLI help text, and runtime messages are written entirely in Chinese, which imposes a specific language on users. There is no indication of a language selection mechanism or a documented justification that this tool is intentionally region- or locale-specific.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The documentation presents the tool as a read-only index builder focused on not altering source files, which suggests a non-destructive operation profile. However, the schema executed later unconditionally drops and recreates contacts, contacts_fts, and meta, so the script performs destructive local state changes each time it rebuilds.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, including conclusions, warnings, and usage guidance. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless the constraint is documented and justified.
Content: No source excerpt is available for this finding.