1688-ai-message-push

• Outcome: Review
• Latest audit: Sep 4, 2026 · 3:21 AM UTC
• Version: 0.8.0

Overview

The skill mostly matches a notification tool, but it also handles and persists API keys in a mismatched cross-skill configuration path and contains misleading DingTalk setup references.

Review before installing. This skill can send live notifications and needs an ALI_1688_AK. The main concern is not the notification feature itself, but that configuration stores and reads that key under a different skill name, includes DingTalk setup text, and can send the key to an environment-selected gateway URL. Only use it in a trusted OpenClaw environment after confirming the intended gateway and credential namespace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Tainted flow: 'gateway_url' from os.environ.get (line 36, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 91% confidence
• Finding: The code takes OPENCLAW_GATEWAY_URL directly from the environment and uses it as the destination for a PATCH request that includes the API key in the JSON body and may also include a bearer token header. If an attacker can influence that environment variable, they can redirect credentials to an attacker-controlled endpoint, creating a clear secret exfiltration path.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述聚焦于“给当前用户自己发送微信或 APP 系统通知”。但提供的代码并未实现微信推送、APP 系统通知、用户自发通知逻辑，也没有任何通知发送编排代码。相反，它实现的是一个底层认证模块，用于为 1688/钉钉相关 API 请求生成签名头，并从环境变量或本地配置中读取 AK 凭证。测试入口明确出现“钉钉消息 API 认证模块”和发送钉钉消息接口路径 `/api/alibaba.1688.official.send.dingtalk.msg/1.0.0`，这与声明的微信/APP 通知能力明显不一致。虽然认证模块可能是消息发送 skill 的配套实现，但从这段代码本身看，其实际行为和声明的核心能力不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description centers on pushing messages to the current user through WeChat and app notifications. However, this code chunk does not implement any messaging behavior at all; it only sets metadata constants and computes a local config file path. Additionally, the docstring mentions DingTalk message sending, which conflicts with the stated WeChat/APP notification scope. While this may be a supporting file, based on the supplied chunk alone, the actual behavior shown does not match the described functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill's core function is pushing notifications to the current user through WeChat or APP/system channels. However, the supplied code chunk is solely a tracking module for analytics: it parses a .env file, derives skill metadata, and sends a usage report to a remote endpoint whenever the CLI runs. This is a materially different purpose from notification delivery, and the network behavior shown is undeclared telemetry rather than self-notification. Therefore the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill sends notifications to the current user through WeChat or app system notifications. However, the provided code does not send any notifications, does not reference WeChat or app push channels, and does not implement any message-pushing behavior. Its primary purpose is entirely different: configuring and validating an AK, checking whether it already exists, and persisting it via a gateway or file. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill pushes notifications to the user through WeChat or app notifications. The supplied code does not implement any notification sending logic, channel handling, user targeting, or trigger handling related to messaging. Instead, it is a configuration-management component for a different apparent purpose: storing and retrieving an AK/API key for '1688-shopkeeper'. It accesses environment variables, a gateway config endpoint, and local config files, which are materially different resources and capabilities from self-notification delivery. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description presents the skill as supporting both WeChat notifications and APP system notifications to the current user. However, the supplied code chunk only exposes a WeChat push command (`wx_push`) with a `--text` argument and calls `send_wx_push`. There is no evidence in this code of APP/system notification functionality, related triggers, or a second channel. The WeChat portion aligns with the description, but the broader declared dual-channel capability is not accurately represented by this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The description says the skill supports both WeChat notifications and APP system notifications for the current user. However, the supplied code chunk only shows a single function, send_wx_push, which sends WeChat push text through a specific API endpoint. There is no code for APP/system notification delivery in this chunk. The observed behavior is aligned with part of the declared purpose (WeChat push), but the declared capabilities are broader than what the code actually implements, so this is a description-behavior mismatch for the supplied code.

Ae1

High

• Category: analysis-evasion

Content

- **实现位置**：`scripts/_tracker.py` → `report_skill_usage()`，在 `cli.py` 的 `main()` 中每次命令执行后自动调用

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The configuration guide is materially inconsistent with the skill metadata: it instructs the agent to collect an AK for DingTalk message sending, even though the skill is supposed to handle only self-notifications via WeChat or app system notifications. This kind of cross-skill mismatch can cause users to disclose credentials for the wrong service and can route agent behavior toward unintended capabilities, which is dangerous in a credential-handling flow.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation explicitly tells the agent to continue by sending DingTalk messages after configuration, which directly contradicts the skill's stated WeChat/App notification scope. In context, this increases the chance of unauthorized or misleading service use and indicates the skill may have been copied from another integration without proper isolation, creating a real security and trust-boundary issue.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This module implements 1688/DingTalk-style request signing and credential handling even though the skill is described as only sending self-notifications via WeChat and app system notifications. That scope mismatch is dangerous because it introduces undisclosed external-service capability and access to API credentials, which could be abused for actions beyond the user’s expected notification-only workflow.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-ai-message-push
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-ai-message-push
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-ai-message-push
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_file() -> None:
    """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""
    env_path = _ROOT_DIR / ".env"
    if not env_path.exists():
        return
    with open(env_path, encoding="utf-8") as f:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s primary behavior is not message pushing but secret configuration and storage, including checking existing config and writing AK values via gateway or file fallback. That mismatch is dangerous because it allows a skill presented as benign notification tooling to perform sensitive credential-management operations, which can facilitate credential harvesting, persistence, or later misuse under misleading packaging.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This command implements credential intake, validation, and persistence for an AK, which is materially unrelated to the skill’s declared purpose of sending notifications to the current user. In a notification skill, hidden or undocumented secret-configuration behavior expands the trust boundary and can enable unauthorized credential collection or storage, especially because users would not expect to provide or persist unrelated access keys in this context.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest describes a self-notification skill, but this configuration code hardcodes SKILL_NAME = "1688-shopkeeper", meaning it writes credentials into a different skill's configuration. That mismatch is highly suspicious because it can silently alter another skill's settings and misroute secrets outside the advertised scope of this package.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This file reads existing credentials from environment and configuration sources, then modifies platform-wide skill configuration, behavior that is not justified by a notification-only skill. In context, this expands the skill's access beyond messaging into credential discovery and persistent platform reconfiguration, which creates strong risk of secret harvesting or unauthorized configuration tampering.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The usage flow tells the agent to directly execute commands, but it does not warn the user there that each command automatically reports a usage record to a gateway. Although telemetry is described later in the document, the execution guidance omits a clear user warning about network reporting that may affect privacy.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI auto-discovers and imports any `scripts/capabilities/*/cmd.py` module, so the executable command surface is determined by filesystem contents rather than an explicit allowlist. In a skill advertised as only supporting self-notification via WeChat and app push, this creates hidden extensibility that can enable undeclared behaviors if extra modules are added, intentionally or accidentally.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Automatic telemetry on every command without user-facing warning undermines transparency and could result in silent data exfiltration of operational metadata. In an agent skill context, hidden reporting is more concerning because users may reasonably expect a narrow single-purpose tool and not background communication unrelated to the requested push action.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to send a real APP system notification but does not require an explicit user-facing warning or confirmation before performing the action. This can cause unintended real-world messaging to the user's account, especially if the user is testing, ambiguous, or unaware that the command triggers an actual push rather than a simulation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.