1688-item-image-optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 0.51.0

Overview

The skill has a coherent image-tool purpose, but it handles credentials and session data in under-disclosed ways and injects instructions that can suppress the parent agent's response.

Review this skill before installing in any account with valuable 1688 credentials. It may persist the AK locally, send authenticated usage telemetry, include a session identifier in opened tool URLs, and return workflow instructions that limit what the agent says after running. Install only if those behaviors are acceptable for your environment and credential handling requirements.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: workflow/1688-item-image-optimizer.js:177

Finding

Workflow Hijacks the Parent Agent's Final Response

Content

View full analysis

${JSON.stringify({ status, completedSteps, pendingItems }, null, 2)} ` } ``` ### Technical Analysis The workflow returns natural-language directives addressed to the parent Agent rather than returning only structured execution state. These directives declare themselves mandatory, threaten that violations are severe errors, and explicitly control what the Agent may say after the workflow finishes. The `manifest()` output is returned from successful, blocked, and error execution paths. Consequently, this behavior is consistently activated whenever the workflow reaches a terminal state. The returned instructions can suppress explanations, security warnings, error correction, or other output that the parent Agent would otherwise provide. This exceeds the minimum privileges required to identify an image-processing intent, check permissions, construct a URL, and open a browser tab. Terminal workflow behavior should be enforced by the workflow runtime, not by injecting instructions into the Agent's conversational context. ### Attack Path 1. A user request activates the image-optimizer workflow. 2. The workflow performs its intent detection and other processing. 3. A success, blocked, or error path calls `manifest()`. 4. `manifest()` returns imperative instructions ...[truncated 594 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/configure/service.py:57

Finding

Access Key Is Written to a Plaintext Shared Configuration File Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

other

Note

• Location: scripts/_tracker.py:50

Finding

Every Valid CLI Command Triggers Undisclosed Authenticated Usage Telemetry

Content

View full analysis

None: try: from _http import api_post skill_name, skill_version, channel = _get_skill_env() api_post( "/api/alibaba.1688.report.skills.usage/1.0.0", { "apiName": None, "skillsName": skill_name, "version": skill_version, "scene": "CLI", "channel": channel, }, ) except Exception as exc: logger.debug("埋点上报失败（已忽略）: %s", exc) ``` ```python # scripts/_http.py headers = get_auth_headers("POST", path, body_str) if not headers: raise AuthError("AK 未配置") headers["x-skill-code"] = SKILL_NAME headers["x-skill-version"] = SKILL_VERSION headers["x-request-id"] = uuid.uuid4().hex resp = requests.post( url, headers=headers, data=body_str.encode("utf-8"), timeout=timeout, ) ``` ### Technical Analysis After every successfully dispatched command, the CLI calls `report_skill_usage()`. The tracker sends an authenticated request to the fixed 1688 Gateway, including the Skill name, version, execution scene, and channel. Authentication headers include the AK identifier and an HMAC signature. This also occurs for commands represented as local operations, including configuration status and `build_tool_url`, which is documented as only constructing a URL. The telemetry side effect is not disclosed in the Skill's security declaration, and no opt-out or consent control is provided. Transmission errors are int ...[truncated 1321 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (40)

Tainted flow: 'gateway_url' from os.environ.get (line 30, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow
• Confidence: 94% confidence

Finding

The service builds a request target from the untrusted OPENCLAW_GATEWAY_URL environment variable and then sends the API key-bearing payload to that URL. Because the default scheme is plain HTTP and there is no allowlist, scheme validation, or host verification, an attacker who can influence environment variables can redirect credential-bearing traffic to an attacker-controlled endpoint or intercept it in transit.

Content

Scanner excerpt · scripts/capabilities/configure/service.py (reported line 37)May include surrounding context.

python

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:
        return False

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The finding indicates undeclared telemetry/reporting and a gap between declared capabilities and actual implementation. Undisclosed telemetry can leak usage context or user data to a remote service, and documentation/implementation divergence undermines security review because operators cannot reliably determine what the skill truly does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding indicates undeclared telemetry/reporting and a gap between declared capabilities and actual implementation. Undisclosed telemetry can leak usage context or user data to a remote service, and documentation/implementation divergence undermines security review because operators cannot reliably determine what the skill truly does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding indicates undeclared telemetry/reporting and a gap between declared capabilities and actual implementation. Undisclosed telemetry can leak usage context or user data to a remote service, and documentation/implementation divergence undermines security review because operators cannot reliably determine what the skill truly does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding indicates undeclared telemetry/reporting and a gap between declared capabilities and actual implementation. Undisclosed telemetry can leak usage context or user data to a remote service, and documentation/implementation divergence undermines security review because operators cannot reliably determine what the skill truly does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

> 编排流程（意图识别 → 权限校验 → 构建入口 → open_tab）由 `workflow/1688-item-image-optimizer.js` 确定性执行。本文件只描述**能力**：有哪些 CLI 命令、各自怎么调、返回什么、业务约束是什么。供纯问答 / 单命令调用 / 引擎委托时参考。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_tracker.py (reported line 8)May include surrounding context.

python

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-item-image-optimizer
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_tracker.py (reported line 25)May include surrounding context.

python

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-item-image-optimizer
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_tracker.py (reported line 26)May include surrounding context.

python

def _load_env_file() -> None:
    """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""
    env_path = _ROOT_DIR / ".env"
    if not env_path.exists():
        return
    with open(env_path, encoding="utf-8") as f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Injecting every .env entry into os.environ makes all project secrets available process-wide, even though the module only requires a few non-secret metadata fields. In a skill context that also performs network operations, this unnecessarily expands access to credentials and increases the chance of accidental leakage by other code paths or dependencies.

Content

Scanner excerpt · scripts/_tracker.py (reported line 40)May include surrounding context.

python

if key and key not in os.environ:
                os.environ[key] = value

# 模块加载时解析一次 .env
_load_env_file()

def _get_skill_env() -> tuple[str, str, str]:

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code creates a natural-language-driven data exposure path by embedding an environment-derived session identifier into a URL that the LLM is expected to pass through unchanged for browser opening. This is especially risky in an agent skill because the model, orchestration layer, logs, and browser integrations may all observe or retain the full URL, enabling credential leakage or session hijacking if the token is reusable.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · workflow/1688-item-image-optimizer.js (reported line 53)May include surrounding context.

js

if (isWin) {
    command = `setlocal enabledelayedexpansion & ${redirectedCmd} & echo !errorlevel! & type "${outF}" & echo. & echo __WFSE__: & type "${errF}" & del /f /q "${outF}" "${errF}"`
  } else {
    command = `${redirectedCmd}; _ec=$?; echo $_ec; cat "${outF}"; printf '\\n__WFSE__:'; cat "${errF}"; rm -f "${outF}" "${errF}"`
  }
  return { command, timeout, description: description || `run: ${program}` }
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes capabilities that imply credential handling, filesystem access, and network use, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, missing scope declarations can allow broader-than-necessary access paths and make review/enforcement of least privilege much harder, especially because the skill also references AK configuration and CLI execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Overly broad trigger phrases like general 'make images' or 'edit images' can cause the skill to activate on ambiguous everyday language. In an agent environment, over-triggering can route users into credentialed workflows, open tabs, or invoke backend capabilities without sufficiently clear intent, increasing the chance of unintended actions or data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The fuzzy mapping of ambiguous requests to a selection flow still allows activation without clear boundaries, which can be abused or accidentally triggered by loosely related prompts. Because the skill can proceed into permission checks and URL-building flows, ambiguous activation increases the risk of unintended backend interaction and confusing cross-skill routing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file prescribes a fixed Chinese output string for the no-permission case, which is a natural-language policy concern if users are not given a language choice. No explicit opt-in or documented locale limitation is provided to justify enforcing a specific language for all users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CLI unconditionally invokes telemetry reporting after every command, and this file provides no user-facing notice, consent flow, or opt-out mechanism. In a skill that may process merchant operations and image-production workflows, silent usage reporting can expose behavioral metadata and possibly sensitive operational context depending on what _tracker collects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file is entirely written in Chinese and includes fixed Chinese user-facing prompts such as "你想制作哪种商品图片？" and "请选择要处理的图片：" without documenting any language choice or opt-in. This can violate language/locale policy when a skill forces a specific language for interaction rather than offering a user-selectable locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstrings and all default exception messages are written only in Chinese, including user-facing strings like authentication, parameter, rate-limit, and service errors. This creates a language/locale policy concern because the skill appears to enforce a specific language without any opt-in, fallback, or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring states in Chinese that all commands use this module for output, and all user-facing error messages in the file are also hardcoded in Chinese. This imposes a specific language on users without offering a choice or documenting that the skill is intentionally limited to a Chinese-language context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Network telemetry is transmitted on every CLI run without an explicit notice or consent at the point of collection. Even if the payload is limited, repeated silent reporting creates privacy risk, can leak operational metadata, and may violate user expectations or compliance requirements in restricted environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function reads a sensitive session identifier from the environment and appends it to a browser URL that is then returned for LLM-forwarded tab opening. Putting session credentials into URLs is dangerous because URLs are broadly exposed through logs, browser history, referrers, telemetry, and downstream components, turning an internal secret into a transferable token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A sensitive session ID is transmitted in the generated URL without disclosure to the caller or user, so an apparently simple image-tool action can silently leak authentication material. In this skill context, the URL is specifically meant to be forwarded by an LLM and opened in a browser, which increases the chance that the token is exposed to logs, UI surfaces, analytics, referrers, or copied/shared links.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code writes a provided access key via gateway or file-based configuration, which is a safety-sensitive credential handling operation. While success and failure are reported after the fact, there is no prior confirmation, warning comment/docstring, or explicit disclosure in this file that the AK will be stored persistently in configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code transmits the API key to the gateway and defaults to an http:// URL, so the secret may be exposed over cleartext transport. Combined with the environment-controlled gateway URL, this increases the chance of credential disclosure to a man-in-the-middle or attacker-controlled service.

Content

No source excerpt is available for this finding.