Shop Health Check

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

The skill mostly does the advertised shop health checks, but its broad outbound network behavior and default report posting need review before use.

Review before installing in any environment with access to internal services. Use only trusted shop URLs, restrict outbound network access where possible, validate or allowlist Feishu webhook domains, prefer --no-feishu unless reporting is intended, and pin dependencies in a virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_404.py:54

Finding

Insufficient URL Validation Enables Blind Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/check_404.py:54-56, scripts/check_404.py:72-74, scripts/check_404.py:108-110, and scripts/check_sites.py:25-27
Vulnerability Type: Blind server-side request forgery through weak hostname validation and unrestricted redirects
Risk Level: Medium

Vulnerable Code

python

# scripts/check_404.py:54-56
full_url = urljoin(base_url, href)
# 只保留同域名的商品页
if base_url.split("//")[1].split("/")[0] in full_url:
    links.add(full_url)

python

# scripts/check_404.py:72-74
response = requests.get(url, timeout=timeout, allow_redirects=True, headers={
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
})

python

# scripts/check_404.py:108-110
resp = requests.get(category_url, timeout=timeout, headers={
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
})

python

# scripts/check_sites.py:25-27
response = requests.get(url, timeout=timeout, allow_redirects=True, headers={
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
})

Technical Analysis

Product links are accepted by testing whether the configured shop hostname appears anywhere in the complete URL as a substring. This does not establish that the parsed destination hostname is the configured hostname.

For example, an attacker-controlled URL can contain the legitimate hostname in its path or query string while its actual hostname points elsewhere. Such a URL can pass the substring condition and subsequently be requested by check_product_page.

Requests also follow redirects automatically. Neither the initial destination nor each redirect target is checked for loopback, link-local, private, reserved, or cloud metadata addresses. A legitimate shop page that has been compromised, or an endpoint that returns an attacker-controlled redirect, can therefore ...[truncated 1881 chars]

Remediation

View remediation

Remediation Suggestions

• Parse every URL with urllib.parse.urlsplit and compare normalized hostnames for exact equality or against a narrowly defined allowlist.
• Permit only the http and https schemes.
• Reject URLs containing user information, malformed ports, or ambiguous hostname encodings.
• Disable automatic redirects and process redirects manually.
• Validate every redirect destination before following it.
• Resolve destination hostnames and reject loopback, private, link-local, multicast, unspecified, and reserved IPv4 and IPv6 ranges.
• Repeat IP validation after every DNS resolution to mitigate DNS rebinding.
• Explicitly block known cloud metadata addresses.
• Apply the same validation to configured base URLs, category URLs, product links, and site-check URLs.
• Where possible, maintain an explicit list of approved shop hostnames and ports rather than accepting arbitrary configuration values.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/report.py:112

Finding

Unrestricted Webhook Destination Can Exfiltrate Reports or Reach Internal Services

Content

View full analysis

Vulnerability Details

File Location: scripts/report.py:112-121 and scripts/report.py:252-261
Vulnerability Type: Arbitrary outbound webhook destination
Risk Level: Low

Vulnerable Code

python

# scripts/report.py:112-121
def send_feishu(card, webhook=None):
    """发送消息到飞书"""
    if not webhook:
        webhook = os.environ.get("FEISHU_WEBHOOK")
    if not webhook:
        print("⚠️ 未配置飞书 Webhook，跳过推送。")
        return False

    try:
        import requests
        payload = {"msg_type": "interactive", "card": card}
        resp = requests.post(webhook, json=payload, timeout=10)

python

# scripts/report.py:252-261
webhook = None
if args.shop:
    try:
        webhook = config.get(args.shop, "feishu_webhook")
    except Exception:
        pass
if not webhook:
    try:
        webhook = config.get("DEFAULT", "feishu_webhook")
    except Exception:
        pass

Technical Analysis

Although the function is presented as a Feishu integration, the supplied webhook URL is passed directly to requests.post without validating its scheme, hostname, port, or resolved address.

The destination can come from either config/shops.conf or the FEISHU_WEBHOOK environment variable. Anyone able to alter one of those inputs can redirect the generated report to an arbitrary external server or an internal HTTP endpoint.

The report can include shop names, domains, checked paths, affected product URLs, availability information, and certificate status. The same behavior also creates a limited server-side request forgery primitive using an HTTP POST request.

Attack Path

1. An attacker obtains the ability to modify config/shops.conf or control the FEISHU_WEBHOOK environment variable.
2. The attacker replaces the expected Feishu endpoint with an attacker-controlled URL or an internal service URL.
3. An operator or scheduled task runs scripts/report.py.

...[truncated 1040 chars]

Remediation

View remediation

Remediation Suggestions

• Require an HTTPS webhook URL.
• Validate the normalized hostname against an explicit allowlist of approved Feishu webhook domains.
• Reject user information, fragments, unexpected ports, and malformed URLs.
• Resolve the hostname and reject loopback, private, link-local, reserved, and metadata-service addresses.
• Store webhook values in a protected secret store rather than ordinary configuration where possible.
• Restrict configuration-file ownership and permissions.
• Prevent untrusted users from controlling the process environment.
• Remove query strings and other potentially sensitive components from product URLs before placing them in reports.
• Consider applying an outbound network policy that allows webhook traffic only to approved Feishu endpoints.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:147

Finding

Runtime Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:147-151
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

markdown

## 依赖安装

```bash
pip3 install requests beautifulsoup4 urllib3 python-dateutil

text

### Technical Analysis

The documented installation command asks pip to retrieve the latest available versions of four packages and their transitive dependencies. No reviewed version constraints, lock file, artifact hashes, or isolated environment are specified.

The listed package names are recognizable PyPI projects, and the audit found no suspicious alternate package index or apparent typosquatting. However, installations are not reproducible and implicitly trust whichever package versions resolve at installation time.

`python-dateutil` is also declared as a dependency but is not imported by any reviewed script, unnecessarily increasing the dependency surface.

### Attack Path

1. A user follows the installation instructions.
2. pip resolves the current versions of the named packages and their transitive dependencies.
3. A compromised, malicious, or unexpectedly incompatible package release is selected.
4. The package is installed with the privileges of the user running pip.
5. Malicious installation behavior or imported runtime code executes when the dependency is installed or when the Skill runs.

This is a supply-chain exposure rather than evidence that the currently named packages are malicious.

### Impact Assessment

If a resolved package or transitive dependency is compromised, code can execute with the privileges of the account performing installation or running the Skill. Depending on that account's permissions, potential impact includes:

- Reading or modifying files accessible to the user.
- Accessing environment variables, including webhook secrets.
- Altering monitoring results.
- Sending arbitrary network requests.
- Per
...[truncated 215 chars]

Remediation

View remediation

Remediation Suggestions

• Pin reviewed direct and transitive dependency versions in a requirements or lock file.
• Record cryptographic hashes and install with pip install --require-hashes.
• Generate dependencies from a trusted, reviewed lock process.
• Install packages in a dedicated virtual environment using a non-privileged account.
• Use only a trusted package index and consider an internally controlled package mirror.
• Scan pinned dependencies regularly for known vulnerabilities.
• Review upgrades before regenerating the lock file.
• Remove python-dateutil unless it becomes necessary for implemented functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'webhook' from os.environ.get (line 99, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/report.py (reported line 107)May include surrounding context.

python

try:
        import requests
        payload = {"msg_type": "interactive", "card": card}
        resp = requests.post(webhook, json=payload, timeout=10)
        result = resp.json()
        if result.get("code") == 0:
            print("📨 飞书推送成功")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

该代码与声明存在明显功能落差。虽然它确实涉及多店铺配置，并检查部分页面的404/内容异常，和“健康度巡检”主题部分相关，但其核心行为是爬取分类页并随机抽检商品页。声明中的几个关键能力——定时执行、站点可用性、响应时间、SSL证书健康度、飞书异常推送——在此代码中都没有体现。代码也没有实现通用“关键页面”清单检查，而是动态抽取商品链接进行检测。因此描述不能准确代表这段代码的实际行为。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

代码与描述部分重合：确实支持多店铺配置，并检查站点可用性、响应时间，以及某种程度上的关键页面 404/非 200 状态。但声明中的多项核心能力在该代码片段中没有实现：没有任何 SSL 证书校验逻辑；没有检查页面内容是否缺失，只是看返回状态码；没有飞书推送代码；也没有定时任务或触发机制，只有一次性命令行执行。因此，描述明显比实际行为更宽，存在实质性不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs use of network access and environment-based secrets such as FEISHU_WEBHOOK, but it does not declare any explicit tool scope or permissions boundaries. This increases the chance that an agent executes the skill with broader-than-necessary capabilities, making accidental secret access or unintended outbound requests harder to govern and audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing instructions, examples, and descriptions in the file are presented only in Chinese, and there is no note that the skill supports other languages or that Chinese is an intentional locale choice. This can violate language/locale policy when a skill effectively forces a specific language without explicit user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language descriptions and operational output in Chinese, but there is no indication that the skill is region-specific or that users can opt into the locale. That can violate language/locale policy because the skill effectively forces a specific language for instructions and results.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings and docstrings in Chinese, including the module description and runtime error/output messages. Under the policy rule for language/locale, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a broader health-check skill that should inspect SSL certificate health, detect key-page 404/content-missing conditions, and automatically push exceptions to Feishu. In this file, the implemented behavior is limited to GET requests, basic 200-status evaluation, and console output; there is no SSL certificate inspection, content validation, or webhook notification logic.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/check_sites.py (reported line 53)May include surrounding context.

python

return config


def check_shop(config, shop_name, timeout=None, webhook=None):
    """检查指定店铺的站点可用性"""
    default_timeout = float(config.get(shop_name, "response_timeout", fallback=3))
    timeout = timeout or default_timeout

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/report.py (reported line 107)May include surrounding context.

python

try:
        import requests
        payload = {"msg_type": "interactive", "card": card}
        resp = requests.post(webhook, json=payload, timeout=10)
        result = resp.json()
        if result.get("code") == 0:
            print("📨 飞书推送成功")

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The '何时使用' section lists natural-language triggers such as '检查店铺健康度' and '巡检店铺' without clarifying boundaries, exclusions, or whether these phrases apply only to configured e-commerce shops. Because there are no negative examples or scope constraints, the skill may be invoked for generic 'health check' requests that are not meant for this specific monitoring workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains user-facing documentation and printed status/error messages in Chinese only, which imposes a specific language on users without opt-in. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module description and all user-facing output in this file are written in Chinese, and the script does not provide any option for users to select another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale-policy concern unless the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.