1688 Item One Click

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.1.0

Overview

This skill is a real 1688 product-management tool, but it has broad merchant write authority and under-scoped credential and pricing-change behavior that users should review carefully.

Install only if you intentionally want this skill to hold a 1688 AccessKey that can modify listings, publish member posts, and potentially set discounts. Use a narrowly scoped key if possible, keep OPENCLAW_GATEWAY_URL trusted and local, and verify every item ID, spi_code, and parameter before approving execute.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Tainted flow: 'gateway_url' from os.environ.get (line 33, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 96% confidence
• Finding: resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly requires environment access, file reads/writes, and network calls. This creates a transparency and policy-enforcement gap: reviewers, users, or an execution framework may underestimate the skill’s real capabilities, including credential persistence and outbound reporting. In this context, undeclared network and file access are more dangerous because the skill stores AK material and automatically reports usage to a gateway.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior expands beyond the declared purpose by adding AK configuration/persistence, a generic SPI execution pattern, and a broader remote-operation workflow. This mismatch is dangerous because a generic execute interface can be repurposed for actions outside the user’s expected scope, while hidden credential handling increases the chance of misuse or overreach. The skill context increases risk because it performs real write operations against external commerce resources.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation presents '设置限时折扣' as supported even though it is outside the declared capability set. This can cause an agent to invoke undeclared write actions on products, leading to unintended business-impacting changes such as pricing or promotion updates. In a commerce skill, undocumented price-affecting actions are especially sensitive because they can directly affect revenue and customer-facing listings.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill documentation materially broadens scope to include limited-time discount configuration, which is not part of the stated manifest operations. This is dangerous because it normalizes unauthorized pricing changes through examples and instructions, making it more likely an agent will execute high-impact commerce actions users did not expect from this skill. Pricing changes have direct financial and reputational consequences, so the context makes this more severe than a typical doc mismatch.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The safety/checklist section instructs agents to process discount parameters despite that capability not being declared. Embedding undeclared actions in operational checklists is risky because agents may treat them as sanctioned behavior and perform unintended write operations. In this skill’s context, that means potential unauthorized promotional or pricing changes to marketplace listings.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes a `spi_hsf_offer_promotion_dszk` discount-setting operation that is خارج the declared skill metadata and advertised capabilities. This creates a scope mismatch: an agent or integrator may invoke an undeclared price-affecting action, enabling unauthorized business-impacting changes and weakening user consent, review, and policy controls that rely on the manifest.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The execute capability documents and enables a limited-time discount write action ('设置限时折扣') even though the skill metadata/manifest only declares title, main image, and member-post operations. This creates a scope mismatch that can cause an agent or user to invoke an undeclared price-affecting action without appropriate review, policy checks, or user expectation.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The operation type table explicitly exposes the discount promotion action and its parameters, which broadens the effective capability beyond the stated skill scope. Because this is a high-impact write operation affecting pricing/promotions, hiding it from the manifest undermines transparency and can bypass governance, approval, or safety controls tied to declared capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The CLI documentation claims a limited command surface, but `_discover_capabilities()` dynamically imports and exposes any `scripts/capabilities/*/cmd.py` module it finds. This creates a hidden/expandable attack surface: a newly added capability can become invokable without explicit review, documentation, or allowlisting, which is risky for a skill that performs privileged item-management actions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This module unconditionally loads data from the project's .env and sends a usage report to a remote gateway on every CLI invocation, even though the advertised skill purpose is item editing rather than telemetry. The behavior is silent and automatic, which creates an undisclosed outbound data flow and expands trust boundaries without clear user consent or operational necessity.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file implements AK validation, discovery, persistence, and global OpenClaw configuration updates, which are outside the advertised scope of a product-editing skill. That scope mismatch increases risk because installing or invoking the skill grants it credential-handling and configuration-modification capabilities the user would not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill checks ALI_1688_AK in the environment and also reads persisted API keys from the global config, giving it credential discovery capability unrelated to one-click product editing. Even if intended for convenience, this broadens access to secrets and can enable unauthorized use, reuse, or exposure of credentials within a skill that users may not expect to touch secret storage.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The code can modify global OpenClaw configuration both through the gateway API and by directly rewriting the config file. For a product-operation skill, this is overprivileged behavior: compromise or misuse of the skill can alter platform state, persist secrets, or tamper with other skills' configuration beyond its declared role.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI presents itself as a bounded 'one-click' product-edit tool, but it accepts an arbitrary spi_code and forwards it to execute_action without local allowlisting or validation. In a skill that is only supposed to support title changes, main-image changes, and member-post publishing, this creates an operation-confusion surface where callers may invoke unintended backend actions if additional SPI codes exist.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The command description states the tool performs only 'modify title/main image', but the implementation accepts any SPI operation code from user input. This mismatch is dangerous because operators, reviewers, or upstream agents may trust the narrower description while the code exposes a more generic execution primitive that could reach undeclared or higher-risk actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that every CLI command automatically reports usage to a gateway, but users are not clearly warned up front about this telemetry behavior. Silent outbound reporting is risky because it creates privacy and compliance concerns, especially when commands may include identifiers, operational context, or metadata tied to commerce activity. The context makes this more sensitive because the skill also handles credentials and product-modification workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The CLI reports usage telemetry after every command via `_tracker.report_skill_usage()` with no visible notice, consent, or control in this file. For a commerce-management skill handling potentially sensitive operational actions, undisclosed telemetry can leak behavioral metadata and violate user expectations or internal compliance requirements.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code performs a network call for telemetry and suppresses all failures, while providing no user-facing notice that execution data is being transmitted. Silent outbound reporting makes auditing and user awareness difficult, and exception swallowing further hides the behavior from operators.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The function persists the provided API key to disk in the OpenClaw config without any notice, confirmation, or visible security controls in this code path. Storing secrets silently increases the chance of accidental persistence, local disclosure, backup leakage, and misuse by other components that can read the config file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code defaults to sending the API key to http://localhost:18789 via the gateway, which is plaintext HTTP, and the file contains no indication of warning or consent. Even on localhost, plaintext transport and redirectable destination settings can expose credentials to local interception, proxying, or malicious local services.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.