1688 Item Image Optimizer

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.1.0

Overview

The skill is advertised as a simple 1688 image-optimization page opener, but the package also includes under-disclosed code for API-key configuration, credential storage, and CLI usage telemetry.

Review before installing. If you only need a page opener for 1688 image optimization, avoid running cli.py configure or providing a 1688 AK unless you understand that the key may be sent to a configured OpenClaw gateway or stored in local OpenClaw config, and that CLI use may report usage metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tainted flow: 'gateway_url' from os.environ.get (line 30, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:
        return False

• Confidence: 94% confidence
• Finding: resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This file reads a local .env file and sends usage telemetry to a gateway on every CLI execution, behavior that is not necessary for a local image-optimization helper. While the code only appears to use SKILL_NAME, SKILL_VERSION, and SKILL_CHANNEL, automatically ingesting .env content broadens access to potentially sensitive local configuration and increases privacy and supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill performs network reporting unrelated to its stated image-optimization purpose every time the CLI runs. Hidden outbound behavior expands the trust boundary, can leak usage metadata, and creates an unnecessary external dependency for a tool users may expect to operate locally.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements an AK credential configuration CLI, which is unrelated to the declared purpose of optimizing 1688 product images. This mismatch is dangerous because it can mislead users into granting or storing sensitive credentials under the guise of an image tool, creating a strong indicator of deceptive capability scope.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code validates and stores an AK through gateway or file-based mechanisms even though the skill is presented as an image optimization assistant. In this context, secret management is unjustified and increases the risk of credential harvesting, persistence of sensitive data, or unauthorized reuse of user secrets.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This skill is presented as an image-optimization assistant, but this file implements credential storage and remote configuration updates instead. That mismatch is security-relevant because users may grant trust based on the advertised purpose while the code handles secrets and modifies broader agent configuration outside the expected image-editing scope.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The described behavior is about opening an image optimization page and adding visual sales elements, but the actual code updates local and remote API-key configuration. This hidden capability expansion increases risk because it performs sensitive operations users would not reasonably infer from the skill description.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad generic terms for image editing and product-image modification, which can cause the skill to activate in contexts the user did not intend. In an agent environment, overbroad invocation can route users into an automated flow that suppresses clarification and opens backend pages, increasing the risk of unintended actions or workflow hijacking.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI reports usage telemetry after every command through `_tracker.report_skill_usage()` with no visible notice, consent flow, or description of what is sent. In a skill that processes product and image-related workflows, silent telemetry can leak behavioral metadata or sensitive business context, especially if command names, identifiers, or error details are included.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Network telemetry is sent on every invocation without any visible user notice or consent in this file, which is a privacy and transparency problem. Silent reporting can expose behavioral metadata such as tool usage frequency, environment/channel identifiers, and potentially correlate activity across users or systems.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code writes sensitive AK material via `configure_via_gateway(ak) or configure_via_file(ak)` without presenting an explicit warning, storage notice, or consent flow about persistence of the credential. Even if the storage destination is legitimate, silently persisting secrets can cause accidental exposure, especially in a skill whose advertised function would not lead users to expect credential handling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API key is persisted to a local config file in plaintext JSON, and this code shows no access-control hardening, encryption, or warning to the user. Local plaintext secret storage increases the chance of credential disclosure through other local processes, backups, logs, or accidental sharing of configuration files.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits the API key to a gateway and defaults to an HTTP URL, which exposes the secret to interception or redirection on untrusted networks. Because there is no visible user disclosure in this code, the secret may be sent off-host without the user's informed consent.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.