Security audit
Security checks for vulnerabilities and agentic risk
Product changes require confirmation, but automatic exports can install extra software despite the main instructions promising a CSV fallback.
Before installing, request an export mode that uses CSV without installing packages, or provision a reviewed dependency in an isolated environment. Keep individual product confirmations until batch cards are supported, and verify the selected products and final changes.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import os
import re
# Skill 名称（供输出文案使用；.env 中的 SKILL_NAME 由平台替换，不在代码里读取）
SKILL_NAME = "1688-item-batch-opt-apply"
# ── 台账与产物路径（均相对当前工作目录）────────────────────────────────────
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest explicitly describes individual task cards as the current application-confirmation mechanism, with batch-apply deferred until that component launches. At L40–L43, the CLI unconditionally instructs the agent to display a batch application confirmation card, without a rollout check or per-task fallback.
The manifest specifies a current per-task single-card application flow and defers the combined batch-apply card until launch. L82–L95 instead always constructs route=batch-apply and persists every included task as requested, with no availability gate or implementation of the declared current flow.
Exporting results unexpectedly triggers a network-backed package installation when openpyxl is missing, rather than taking the promised CSV fallback. This crosses the export operation's expected boundary and can introduce unreviewed dependency code or alter shared environment dependencies without explicit authorization.
The subprocess call does not expose shell injection because its arguments are fixed, but it silently installs an unpinned package during an ordinary export operation. This introduces a supply-chain execution path and modifies the running Python environment using the configured package index, despite the documented CSV fallback.
if _HAS_OPENPYXL:
return openpyxl
try:
subprocess.run(
[sys.executable, "-m", "pip", "install", "--quiet", "openpyxl"],
check=True, timeout=120,
stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
fd, path = tempfile.mkstemp(prefix="batch-cpv-", suffix=".json")
with os.fdopen(fd, "w", encoding="utf-8") as stream:
json.dump({"items": items}, stream, ensure_ascii=False)
result = subprocess.run(
[executable, "call", "query_offer_prop", "--json-file", path, "--raw"],
shell=False, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace",
The open-ended version constraint allows installations to consume future, unreviewed releases and does not provide reproducible dependency resolution. A compromised or defective eligible release could affect the agent environment, although no compromised dependency is demonstrated here.
# openpyxl 用于结果导出为 .xlsx；缺失时自动降级 csv（utf-8-sig，
# Excel 打开不乱码），不因缺依赖阻断主流程。
# 注：任务输入侧（Excel 等文件）由主 Agent 自行读取结构化，不走脚本解析。
openpyxl>=3.0.0
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.