Security audit

1688 Cowboy

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches a 1688 customer-service assistant, but it needs Review because it handles credentials, store/customer data, cloud knowledge persistence, and local-folder syncing with weak or incomplete disclosure and controls.

Install only if you trust this publisher with 1688 merchant operations, customer/order/conversation data, and AK credentials. Before enabling it, verify OPENCLAW_GATEWAY_URL points to a trusted local/admin gateway, protect ~/.openclaw/openclaw.json from backups or sharing, review the store-data authorization scope, and use dedicated folders for knowledge sync rather than broad local directories.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The whitelist includes an undocumented `cowboy_config` command even though the file comments claim only currently declared external capabilities are exposed. Undocumented command exposure increases attack surface and can enable unauthorized or unintended configuration actions, especially in an assistant skill that should have tightly bounded business functions.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The docstring asserts that only whitelisted, currently claimed external capabilities are exposed, but the code later includes an extra undocumented command. This discrepancy is dangerous because reviewers and operators may trust the documentation and miss hidden or legacy functionality, allowing risky commands to persist without proper scrutiny.

Description-Behavior Mismatch

Low

Confidence: 93% confidence
Finding: The file implements automatic usage telemetry to a skill gateway on every CLI invocation, but the provided skill metadata/description does not disclose this network reporting behavior. Undisclosed telemetry is a security and privacy concern because users and operators cannot make an informed trust decision, and the code silently suppresses failures, further reducing transparency.

Description-Behavior Mismatch

High

Confidence: 91% confidence
Finding: This command implements AK credential write functionality, which is outside the declared scope of a customer-reception assistant skill. Even though it includes validation and a confirmation flow, embedding secret-management capability in a business-facing skill materially expands privilege and creates an opportunity for prompt-injection-driven credential overwrite or unauthorized reconfiguration.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The write path accepts and persists a credential after a confirmation step, giving this skill effective credential-management power that is not justified by its stated business role. In an agent environment, such hidden administrative capability is dangerous because a misrouted invocation, social engineering, or prompt injection could cause credential replacement, denial of service, or redirection of downstream API access.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: This skill includes logic to accept, process, and persist a raw API key even though the stated receptionist-assistant business scope does not justify direct secret-management behavior. That expands the skill's privilege boundary and creates unnecessary secret-handling risk: any UI path or caller that reaches this code can cause sensitive credentials to be stored and later retrieved from process environment or config.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes very broad everyday terms such as `招聘`, `接待`, `培训`, and `知识库`, which can easily match unrelated merchant conversations. Over-broad activation can route users into this skill unexpectedly, causing unintended data access, workflow changes, or UI actions like opening management tabs when the user did not actually intend to manage the reception assistant.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The fallback rule maps vague phrases like `知识库` or `学一下` directly to `knowledge_query` §3.1 without requiring the user to specify whether they want pending questions, local files, or another knowledge operation. In context, this can expose operational knowledge data or open management UI based on an underspecified request, increasing the chance of unintended disclosure or confusing actions.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The intent routing table uses short, high-frequency phrases such as `招聘`, `看看配置`, `待完善`, and `知识库` as direct routing conditions. Because this skill is the '唯一对话入口', misrouting is more dangerous here than in an isolated helper skill: an ordinary conversation can trigger report retrieval, knowledge queries, or management-page navigation without sufficient confirmation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill states that submitted answers are automatically written into a cloud knowledge base and used for future customer responses, but it does not describe any explicit user confirmation, review step, or guardrail before this persistent action occurs. In an agent context, this creates a real integrity risk: an accidental, low-quality, or manipulated answer could be committed to shared business knowledge and then propagated to future buyer interactions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger guidance uses broad natural-language phrases like “调整分活配置” and “暂停牛仔” to open a real-time configuration panel that changes live routing behavior. Without stronger scope confirmation or authorization checks in the skill contract, an ambiguous or indirect user utterance could cause unintended operational changes such as pausing automated reception or altering buyer-routing rules.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The document states that users can add a local folder path and the system will automatically parse documents and sync them to a cloud knowledge base (OSS), but it does not clearly warn that local files will be transmitted off-device and potentially include sensitive business or personal data. In an agent skill that guides users into enabling this feature, the absence of an explicit privacy and scope warning increases the risk of accidental exfiltration of confidential data from local directories.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This code sends network telemetry on every CLI run via api_post without any user-facing warning or consent mechanism in the file. Even though the payload appears limited to skill metadata, automatic outbound communication can leak operational usage patterns and creates an unexpected network side effect in a CLI tool.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The function writes the API key directly into a persistent JSON config file in plaintext. Plaintext credential persistence increases the chance of compromise through local file disclosure, backups, logs, support bundles, or overly broad filesystem permissions, and the code provides no user-visible disclosure or guardrails around this storage behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function returns buyer-identifying fields such as buyer nickname, login ID, company name, tags, and avatar, and the Markdown formatter renders them directly for merchant-facing output. Even though the comments say buyerLoginIdEncode is withheld, this code still exposes multiple pieces of personal or business-identifying information without any access-control check, minimization, masking, or user-facing privacy handling in this file. In a customer-service assistant context, that makes unintended data exposure more plausible because the skill is designed to surface inquiry records to operators.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.