1688 Item Select

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.1.0

Overview

This skill is mostly coherent for 1688 product analysis, but it needs review because it stores a sensitive access key while calling setup read-only and it sends usage reports after commands.

Review before installing. Use a least-privileged 1688 access key, understand that configure saves that key for later signed API calls, and remove or rotate it if you stop using the skill. Treat the setup step as credential-changing, not read-only, and be aware that each CLI command sends a usage record to the gateway.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document labels `configure` as 'read-only' and safe to execute without confirmation, but that command writes an Access Key to local configuration. Misclassifying a state-changing credential operation as read-only can lead agents or users to execute it automatically, risking credential persistence, accidental overwrites, or unsafe handling of secrets.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The CLI performs post-execution telemetry by importing `_tracker.report_skill_usage()` after every command, but this behavior is not described in the stated skill purpose or visible interface. Undeclared tracking creates a privacy and trust risk because users may unknowingly transmit usage metadata, and the broad exception handling suppresses visibility into what is being collected or where it is sent.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The usage-reporting hook is unrelated to the core product-selection functionality, so it introduces extra data-handling behavior without a clear operational need in this file. Even if the collected data is limited, unnecessary telemetry expands the attack surface and can lead to privacy, compliance, or user-consent issues if later modified to send more sensitive execution context.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file performs outbound telemetry reporting on every CLI invocation, which is unrelated to the stated item-selection/search business logic and is not disclosed in the skill description. Even though the payload is limited to skill metadata, undisclosed network reporting expands the skill’s trust boundary and can violate privacy, compliance, or platform expectations.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The module automatically reads a local .env file at import time and injects its contents into process environment variables to support telemetry configuration. This is broader capability than necessary for item selection and creates unnecessary exposure to local secrets or unintended configuration influence, especially because it happens implicitly on import.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: This skill includes credential configuration and persistent config mutation even though the declared purpose is product scoring and selection. That scope expansion is dangerous because it grants the skill access to sensitive configuration pathways unrelated to its business function, increasing the blast radius if the skill is abused or invoked unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code reads API keys from environment and config sources and can also write them back, which is not directly necessary for item selection functionality. In a skill whose stated role is business analytics, embedded credential handling creates unnecessary access to secrets and persistence mechanisms, making misuse more dangerous in context.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Overly broad trigger phrases such as generic shopping/selection terms can cause the skill to activate in contexts the user did not intend. Because the skill can read files, use networked APIs, and potentially write local configuration, accidental invocation increases the chance of unnecessary data access, external requests, or execution of the wrong workflow.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that every CLI invocation automatically reports a usage record to a gateway, but it does not clearly disclose what data is sent, whether identifiers or query contents are included, or how users can consent or opt out. Silent telemetry on merchant/product workflows can expose sensitive business metadata or credentials-adjacent context to external systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends usage data over HTTP via api_post without any user-facing notice, consent flow, or visible control in this file. Silent telemetry on each CLI execution can surprise users and create privacy and governance risks, especially in enterprise environments where outbound reporting must be disclosed and approved.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The API key is written in plaintext into a local configuration file without any indication here of user disclosure, encryption, or permission hardening. This is dangerous because local config files are often broadly readable by the same user context, backups, logs, or support tooling, which can expose credentials beyond their intended use.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code transmits the API key to a gateway endpoint and defaults to plain HTTP on localhost, with no visible transport security enforcement or user-facing disclosure in this file. If the gateway URL is changed to a remote or intercepted endpoint, the credential could be exposed in transit or sent to an unintended service.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.