Security audit

Competitor Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent competitor price monitor, but it uses overbroad network and file-writing behavior that needs review before installation.

Review this skill before installing. Use it only with trusted configuration files, restrict product URLs to real marketplace hosts, keep webhook notifications disabled unless the destination is verified, and avoid running it as a privileged user or on a network where it can reach internal services.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:194
Finding: Configuration-Controlled Product URLs Enable Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:278
Finding: Unsanitized Product Names Are Used to Construct Writable File Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/monitor_v2.py:89
Finding: Unrestricted Notification Webhook URLs Enable Blind Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill advertises one purpose while also including undeclared outbound notification capability via WeCom and DingTalk webhooks. Hidden or insufficiently declared network egress can expose monitored product data, business intelligence, or user-configured identifiers to third-party endpoints, especially in a competitor-monitoring context where collected data may be commercially sensitive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill advertises one purpose while also including undeclared outbound notification capability via WeCom and DingTalk webhooks. Hidden or insufficiently declared network egress can expose monitored product data, business intelligence, or user-configured identifiers to third-party endpoints, especially in a competitor-monitoring context where collected data may be commercially sensitive.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises one purpose while also including undeclared outbound notification capability via WeCom and DingTalk webhooks. Hidden or insufficiently declared network egress can expose monitored product data, business intelligence, or user-configured identifiers to third-party endpoints, especially in a competitor-monitoring context where collected data may be commercially sensitive.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill metadata does not declare any tool scope or permissions, yet the documented behavior includes reading configuration files, writing output/history, scheduling cron jobs, and sending outbound webhook/email notifications. This creates an authorization and transparency gap: users and the platform cannot accurately evaluate what the skill may access or where data may be sent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description and the entire user-facing README content are written in Chinese, and there is no indication that users can select another language or that the skill is intentionally limited to a Chinese-speaking or China-only compliance context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file-level natural-language description and all user-facing messages are written exclusively in Chinese, indicating the skill is intended to operate in a fixed language/locale. There is no visible option or documented mechanism for the user to choose another language, which conflicts with the policy against forcing a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The alert content shown to users is entirely hard-coded in Chinese, including headings, recommendations, and status labels. Because the skill does not offer any user choice of language or state a justified region-specific restriction, this is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 技能描述声明其用途是自动追踪竞品价格变动和上下架状态，属于监控与跟踪范畴。但这里在告警消息中加入“是否跟进”“建议价格：略低于竞品”等决策与定价建议，已经从监控扩展到经营策略输出，不再只是状态追踪。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill manifest describes a competitor monitoring assistant that supports 淘宝/京东/拼多多/亚马逊, and the module docstring similarly presents this as a production monitoring tool. In actual code, platform handling in check_product only covers jd.com, taobao.com, and tmall.com, with no Pinduoduo or Amazon implementation, and Taobao uses mock data rather than real tracking.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level docstring states '生产版 v2' and '真实数据抓取', which implies live platform data collection. However, get_taobao_price explicitly labels the result as simulated data and returns hard-coded prices because authorization is unavailable, directly contradicting the 'real data' claim for that supported platform.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file's natural-language strings and stated functionality are entirely Chinese-specific, including user-visible messages and messaging content, with no indication that users can opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code sends generated monitoring messages to external WeCom webhook endpoints, which transmits business data off-host. While there are success/failure prints, there is no user-facing warning or explanatory comment/docstring indicating that monitored product details will be sent to third-party messaging services, so the data transmission lacks meaningful disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: This code transmits monitoring results to an arbitrary webhook URL from configuration without any validation or restriction. In this skill context, competitor pricing and monitoring activity can be commercially sensitive, so a misconfigured or maliciously altered webhook can silently exfiltrate business intelligence to an attacker-controlled endpoint.
Content: Scanner excerpt · scripts/monitor_v2.py (reported line 100)May include surrounding context.
python
} } response = requests.post(webhook_url, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json()

Tainted flow: 'data' from requests.post (line 45, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/monitor_v2.py (reported line 100)May include surrounding context.
python
} } response = requests.post(webhook_url, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json()

Tainted flow: 'data' from requests.post (line 45, network input) → requests.post (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/monitor_v2.py (reported line 125)May include surrounding context.
python
} } response = requests.post(webhook_url, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json()

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function posts alert messages to a DingTalk webhook, sending monitored pricing information to an external service. Existing log messages only report send success/failure and do not clearly disclose the nature of the outbound transmission, leaving users without an explicit warning about external sharing.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: The DingTalk notification path also sends alert content to a configurable external URL with no destination validation. Because the tool monitors competitor pricing, unauthorized outbound transmission could leak sensitive market-tracking data or internal response recommendations to third parties.
Content: Scanner excerpt · scripts/monitor_v2.py (reported line 125)May include surrounding context.
python
} } response = requests.post(webhook_url, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json()

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: A full-file natural-language presentation in a single language can be a locale policy concern when no user choice or explicit scope is provided. Here, the skill documentation forces Chinese as the only visible language and does not state that the skill is region-specific or otherwise intentionally limited.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file includes configuration for a WeChat webhook and shows that price-change alerts are pushed externally. While the README explains how to configure the webhook, it does not explicitly warn users that monitoring results and related metadata will be sent to a third-party service, which is a user-facing disclosure relevant to privacy and data handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The configuration uses Chinese-only product names in user-facing values, which can indicate a fixed language/locale assumption. The file does not provide any language selection, opt-in mechanism, or documentation that this skill is intentionally limited to a Chinese marketplace context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire markdown alert is presented in Chinese, including labels and status text, with no indication that the user opted into this locale or that the skill is region-specific. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.