1688 Distribution Amazon

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:02 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its Amazon draft-listing purpose, but it includes unnecessary command-line paths that can expose a store credential.

Review this skill before installing if you are uncomfortable giving it Dianxiaobao, AlphaShop, and 1688 image-gateway credentials or sending product images and listing data to those services. Prefer the documented session-based commands, avoid any direct encryptedCode command-line usage, protect the local .env and /tmp session files, and rotate credentials if they may have been exposed in shell history or logs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_session.py:62

Finding

Dianxiaobao Credential Exposure Through the Session Initialization Command Line

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/map_amazon_attrs.py:461

Finding

Legacy Amazon Attribute CLI Mode Exposes Dianxiaobao Credential in Process Arguments

Content

View full analysis

OR [evaluated|hard|conditional|all]", file=sys.stderr, ) sys.exit(1) else: mode = sys.argv[4] if len(sys.argv) >= 5 else None print(dump(get_amazon_attrs(sys.argv[1], sys.argv[2], sys.argv[3], required_mode=mode))) ``` ### Technical Analysis The legacy execution branch treats `sys.argv[1]` as `encryptedCode` whenever the first argument is not a session directory and at least three positional arguments are present. The credential is then used by `get_amazon_attrs()` as `userCode` in a request to Dianxiaobao. This design exposes the credential in the process argument vector. It may therefore be captured by shell history, process inspection, command auditing, CI output, monitoring agents, or wrapper-script logging. The Skill's documented workflow uses a protected session directory containing `query_user_info.json`; direct credential mode is not necessary to perform Amazon attribute mapping. The repository already disables direct credential CLI mode in `release_product.py`, demonstrating that a safer session-based pattern is available. ### Attack Path 1. A user follows the advertised legacy syntax: ```bash python scripts/map_amazon_attrs.py \ '' \ 'Target Store' \ 'DRINKING_CUP' ``` 2. The Dianxiaobao credential appears in the process argument vector and may be persisted in command history or execution logs. 3. An attacker with access to local process metadata, retained histories, or monitoring records retrieves the credential. 4. The attacker reuses it as `userCode` in requests to Dianxiaobao services, subject to the crede ...[truncated 616 chars]

Remediation

View remediation

", file=sys.stderr, ) sys.exit(1) ``` 2. Continue reading `encryptedCode` only from `query_user_info.json` in an owner-only session directory. 3. Remove `` from usage messages and supporting documentation so users are not encouraged to place credentials in commands. 4. If a non-session integration is required, accept the credential through a protected file descriptor or standard input and ensure that errors never echo it. 5. Apply the shared `redact_sensitive()` function to unexpected exceptions or diagnostic structures that could contain request payloads. 6. Review and sanitize existing shell histories, CI logs, and telemetry records. Rotate credentials if prior command-line use may have been recorded. 7. Add tests that reject all non-session invocations and verify that credential values never appear in stdout, stderr, or process command construction. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a substantial workflow for converting 1688 products into Amazon draft listings for 店小宝. However, the provided code chunk is only an empty package initializer with a descriptive docstring and does not implement any of the stated capabilities. Based on the supplied code alone, the actual behavior is effectively non-functional metadata, which is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a full Amazon listing-draft workflow for 1688 products, but the supplied code chunk only selects and launches a Python 3 interpreter. While environment checking is mentioned in the description, this code does not implement the advertised business functionality and instead serves as a generic runtime bootstrapper. Therefore the code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

bash scripts/run_python.sh scripts/process_images.py <session_dir>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

bash scripts/run_python.sh scripts/process_images.py <session_dir>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

bash scripts/run_python.sh scripts/process_images.py <session_dir>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

bash scripts/run_python.sh scripts/process_images.py <session_dir>

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/build_product.py (reported line 202)May include surrounding context.

python

"串珠链": "Beaded Chain",
        "Fashion": "fashion",
        "Fine": "fine",
        "No Warning Applicable": "no_warning_applicable",
    }
    if value in replacements:
        return replacements[value]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/common.py (reported line 22)May include surrounding context.

python

def load_env() -> None:
    env_path = Path(__file__).resolve().parent.parent / ".env"
    if not env_path.exists():
        return
    for raw_line in env_path.read_text().splitlines():

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs execution of multiple shell/Python scripts, uses environment variables containing access keys, reads and writes session files, and clearly implies network/API access, yet it declares no explicit tool/permission scope. Without least-privilege restrictions, an agent may grant broader shell, file, and network access than necessary, increasing the blast radius if the skill or any referenced script is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Line L51 states that image processing may append translate_to_en when a category or platform requires language handling. This imposes a specific language transformation in natural language instructions without indicating user choice, opt-in, or a clearly documented regional/compliance justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The build function unconditionally assigns a marketplace and language tag from defaults or environment variables when none are provided. This creates a locale policy risk because output language/marketplace behavior is fixed implicitly rather than chosen by the user or clearly limited to a justified region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring states in Chinese that this check 'must be executed first' upon receiving an Amazon listing request, and the user-facing output strings are also fixed in Chinese. This indicates a language/locale assumption without any opt-in or documented justification, which conflicts with the policy against forcing a specific language.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.py (reported line 70)May include surrounding context.

python

def post(url: str, payload: dict[str, Any], headers: dict[str, str] | None = None, timeout: int = 20) -> dict[str, Any]:
    import requests

    response = requests.post(url, json=payload, headers=headers, timeout=timeout)
    response.raise_for_status()
    return response.json()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes image processing in terms of white background handling, cropping, and translation for Amazon listing drafts. General-purpose detect-elements and remove-elements operations introduce broader image analysis/editing functions, including logo, watermark, QR code, and character removal, that are not clearly necessary for the declared workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest scopes image handling to Amazon listing preparation tasks such as white background, cropping, and translation. This file additionally exposes virtual try-on submission/query and model-change generation APIs, which are marketing/creative image generation features not justified by the stated purpose of turning 1688 items into Amazon draft listings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends payloads containing image URLs and processing parameters to an external HTTP endpoint via requests.post. While the module docstring mentions an image gateway, there is no user-facing confirmation, warning, or explicit disclosure in the code that offer image data will be transmitted to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file makes an HTTP POST request to query Dianxiaobao user information using a user ID, which may transmit user or account data to an external service. Aside from a brief module docstring, there is no confirmation prompt, user-facing log/print, or explanatory comment near the operation disclosing that account information is being fetched.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This function also performs an HTTP POST to retrieve account/store data tied to DXB_USER_ID. There is no nearby comment, log, or prompt informing the user that executing this path will contact a remote service and fetch account-linked store information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level docstring says 'release Amazon listing through Dianxiaobao', which implies actual publishing. However, the implementation hard-restricts release type to 'localSave' via release_type() and validate_release_type(), and even emits a draft-only message stating publishing is not supported. This is an active contradiction between documentation and behavior, not just missing detail.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_local_save.py (reported line 57)May include surrounding context.

python

def _run_script(label: str, script_name: str, *args: str, timeout: int = 180) -> None:
    command = [sys.executable, str(SCRIPTS / script_name), *args]
    result = subprocess.run(
        command,
        cwd=str(ROOT),
        capture_output=True,

Unverifiable Dependency: PyJWT has 16 known advisory(ies) (CVE-2026-32597 (PyJWT accepts unknown `crit` header extensions); CVE-2024-53861 (PyJWT Issuer field partial matches allowed); CVE-2026-48522 (PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest specifies PyJWT with a lower bound only (>=2.8.0) rather than pinning or constraining to a known-safe range, so builds may resolve to vulnerable versions depending on install time and index state. In a skill that likely handles authenticated sessions and tokens for Amazon/store workflows, a vulnerable JWT library could affect token validation or enable abuse if the code relies on affected features.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The requests dependency is not pinned, so deployments may install a release affected by known vulnerabilities, making the security posture unverifiable. Given this skill’s purpose involves network access to external services and likely session initialization, any requests flaw involving credential leakage, SSRF, or TLS/verification behavior is more relevant than in an offline tool.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown file states that image-processing authorization uses ALI_1688_AK and a CSK signature, which indicates the skill relies on sensitive credentials. The reference describes the secret usage but does not include any warning to users about credential sensitivity, storage, or exposure risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code emits user-facing error and guard messages only in Chinese, such as the session path errors and missing-field messages. The file also defines a default language tag of en_US, but the actual prompts do not offer any language/locale choice or document a justified locale restriction, which fits the policy-violation criterion for forced language without opt-in.

Content

No source excerpt is available for this finding.