1688 Customer Opportunity

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.1.0

Overview

The skill mostly fits a 1688 CRM marketing workflow, but it needs Review because it handles sensitive account keys and customer outreach with inconsistent credential handling and undisclosed usage reporting.

Install only if you trust the publisher with your 1688 account credential and customer data. Before providing an AK, verify why the guide mentions DingTalk, check where the key is stored, and review any Wangwang marketing-plan confirmation because it can start customer outreach.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 92% confidence
• Finding: resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: Allowing phone-number input for buyer lookup and recommendation expands the data sensitivity significantly beyond the declared scope centered on buyer accounts and customer groups. Phone numbers are direct personal identifiers, and introducing them without manifest-level disclosure or clear safeguards can lead to privacy, compliance, and misuse risks. In this business context, the data can be used to resolve identities and drive targeted outreach.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The document describes offline file parsing and batch buyer analysis flows that are not represented in the declared interaction model. Undeclared bulk-ingestion behavior changes the threat surface by enabling mass processing of customer identifiers from uploaded files, which can increase privacy exposure, accidental overcollection, and abuse potential. This is more sensitive in a CRM-like skill because batch operations can affect many customers at once.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill references and requires use of an additional capability, `customer_crowd_analysis`, that is not disclosed in the skill description. Undocumented capabilities weaken reviewability and may grant operators or downstream components access to analyses users did not expect, especially when tied to customer segmentation and targeting. Hidden analytical functions in a marketing/customer dataset context can materially affect privacy and compliance risk.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The configuration guide is for collecting and installing a DingTalk Access Key, but the skill is घोषित as a 1688 customer-operation tool. This mismatch indicates hidden or undocumented capability expansion: the agent could solicit unrelated credentials and then act on an external messaging platform, which materially increases the risk of credential misuse, covert exfiltration, or unauthorized outbound messaging.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill documentation instructs the agent to configure credentials for DingTalk message sending even though that capability is not justified by the stated 1688 buyer follow-up use case. In this context, undocumented message-sending capability is dangerous because it can be used to contact third parties, move data across systems, or abuse user-provided credentials outside the user's reasonable expectations.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The module silently reports every CLI invocation to a remote gateway, but the skill description does not disclose this telemetry behavior. Hidden network reporting undermines informed consent and can expose operational metadata such as tool usage patterns, channel, and version to a third party.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: The code parses the project .env file at import time and injects values into the process environment solely to configure telemetry fields. Reading local configuration outside the stated customer-operations purpose expands access to potentially sensitive developer or deployment settings and creates unnecessary coupling between the skill and local secrets storage.

Description-Behavior Mismatch

High

• Confidence: 87% confidence
• Finding: This command implements AK credential configuration and secret-handling behavior that is outside the skill’s declared buyer follow-up and customer opportunity scope. In a mismatched business context, hidden credential-management features expand the skill’s privileges and can facilitate unauthorized secret collection, persistence, or operator confusion about what the skill actually does.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The code reads environment and configuration state to determine whether an AK exists and where it came from, which is secret-management behavior unrelated to the stated customer-operations use case. Even though it masks displayed values, accessing and reporting secret presence/source can expose sensitive operational metadata and indicates the skill has broader secret-handling access than users would reasonably expect.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements credential collection and global configuration mutation for API keys, which is materially different from the declared customer-operation functionality of the skill. That mismatch is a strong supply-chain red flag because users enabling a buyer-followup skill would not reasonably expect it to manage AK secrets and patch global skill configuration, creating an opportunity for covert credential capture or cross-skill tampering.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module presents itself as an AK configuration service but hardcodes a different target skill name, "1688-open-skill-template," instead of the current skill. That inconsistency suggests the code may be writing secrets into another skill's configuration, which is suspicious and can cause cross-skill credential exposure or unauthorized reconfiguration.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The skill promotes activating automated marketing outreach plans and sending Wangwang marketing copy without a clear up-front warning about the customer-contact impact. This can lead to unintended mass outreach, customer annoyance, compliance issues, or reputational harm if a user triggers contact actions without understanding they have real external effects. The risk is elevated because the skill is specifically designed for customer operations and campaign activation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The CLI unconditionally reports skill usage after every command, and this file provides no user-facing notice, consent mechanism, or opt-out. In a customer-operations skill that may process buyer identities, segmentation, and marketing actions, silent telemetry can expose sensitive operational metadata and create privacy/compliance risk even if the reporting is "best effort."

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide tells the agent to extract an Access Key directly from user messages and pass it to a CLI command, but provides no warning about sensitive credential handling, redaction, storage, or display controls. This creates a realistic risk of accidental exposure in chat history, logs, process arguments, error output, or downstream tooling, especially because the agent is explicitly instructed to continue operating after configuration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documentation explicitly exposes buyer account identifiers (`buyer_login_id`) and directs operators to use them for contacting buyers in Wangwang, but it provides no privacy, consent, access-control, or data-handling safeguards. In a customer-operations context this may be intended business functionality, but documenting direct account exposure and contact-oriented use without warnings or restrictions increases the risk of misuse, unauthorized outreach, and privacy/compliance violations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The capability documents bulk lookup of buyer details by login ID and returns customer profile and behavioral fields such as credit level, procurement mode, inquiry timing, and transaction-related segmentation without any privacy, authorization, or data-minimization warning. In a customer-operations skill, this is sensitive business/customer intelligence, and the lack of explicit access-control and handling guidance increases the risk of unauthorized enumeration, over-collection, and misuse of customer data.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code writes the API key into a persistent global config file on disk, with no indication here of encryption, secret-store use, file permission hardening, or user disclosure. Storing plaintext credentials in a shared configuration file increases the chance of local disclosure through backups, logs, other processes, or broader-than-expected file access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This function transmits the API key in the request body and may also send a bearer token in headers, but the destination is configurable and defaults to an HTTP endpoint. Sending secrets over an unverified or non-TLS channel can expose them to interception, proxy capture, or accidental transmission to the wrong service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The CLI explicitly accepts buyer login IDs and phone numbers, then forwards them to a downstream service without any user-facing notice, consent prompt, masking, or data-handling warning. Because these identifiers are customer personal data and the skill is designed for customer profiling and follow-up recommendations, silently transmitting them increases privacy, compliance, and misuse risk, especially if operators do not realize the data leaves the local CLI context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The command renders buyer_login_id values directly into markdown output and also serializes them into a machine-readable HTML comment field, which increases exposure of customer identifiers beyond the minimum needed for display. In a customer-operations skill, these identifiers are expected business data, but emitting them without masking, access checks, or user warning can enable unintended disclosure through logs, transcripts, screenshots, downstream tools, or exported artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.