1688 Item Title Optimizer

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:45 PM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate 1688 title optimizer, but it requires a 1688 access key, makes backend calls, stores configuration, and reports basic CLI usage.

Install only if you are comfortable giving this skill a 1688 AK and sending product IDs/title-related data to the 1688 skills gateway. Use a scoped or rotatable key if available, verify OPENCLAW_GATEWAY_URL points to your trusted local gateway before running configure, and carefully review any generated title before confirming a live listing update.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tainted flow: 'gateway_url' from os.environ.get (line 30, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:
        return False

• Confidence: 88% confidence
• Finding: resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The manifest declares no permissions, yet the documented behavior clearly includes environment access, file reads/writes, and outbound network activity. This creates a transparency and consent problem: operators and users cannot accurately assess what the skill can access or transmit, especially given AK configuration/persistence and telemetry reporting.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a narrow title-optimization helper, but the spec also includes credential configuration, local persistence, keyword/tokenizer retrieval, and automatic telemetry on every CLI invocation. This mismatch can mislead users and reviewers about the true behavior and expands the trust boundary beyond simple title rewriting.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: Automatic usage telemetry to a remote gateway on every command is a secondary behavior not inherent to title optimization and is easy to miss in a user-facing manifest. Even if the payload is limited, undisclosed outbound reporting can expose operational metadata and violate user expectations or internal policy.

Context-Inappropriate Capability

Low

• Confidence: 87% confidence
• Finding: Adding AK configuration and gateway authentication broadens the skill from content optimization into credential handling, which is more sensitive than the manifest suggests. If users are not clearly informed, they may provide secrets to a skill they believe only rewrites titles, increasing the risk of accidental credential exposure or improper storage.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The code unconditionally attempts to report skill-usage telemetry after every command, with no visible user notice, consent check, or configuration gate in this file. Silent telemetry can leak command usage patterns and potentially associated metadata, which is especially concerning in an agent skill where users may not expect background reporting.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document defines two conflicting fallback behaviors for malformed table selections: an earlier section requires re-prompting on cross-plan or incomplete selections, while the later fallback section says to heuristically choose the largest group or fall back to a default title. In a title-application workflow, this ambiguity can cause the agent to apply a title the user did not explicitly choose, creating integrity and unintended-action risk rather than direct code execution risk.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The guide embeds examples for powerful side-effecting actions such as writing directly to a database, creating orders, blacklisting items, and opening arbitrary external pages, none of which are aligned with a title-optimization skill. In an agent setting, examples often become de facto behavior templates, so this materially increases the chance the model will surface or invoke unsafe capabilities beyond the skill's intended scope.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This code performs hidden telemetry on every CLI invocation by sending skill metadata to a remote endpoint, while the stated skill purpose is title optimization and the file provides no user-facing disclosure or consent flow. Undisclosed network reporting creates a privacy and trust risk because users may not expect any outbound call when using a local text-processing skill.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module parses the project-root .env file at import time and injects values into process environment variables for telemetry configuration, which is broader access than needed for title optimization. Reading .env files can unintentionally expose or normalize sensitive configuration handling in a component whose main job should not require environment harvesting.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements a credential configuration CLI for an AK secret, which is materially unrelated to the declared skill purpose of 1688 item-title optimization. In a skill ecosystem, unexpected secret-handling behavior expands the attack surface and can enable unauthorized credential collection, storage, or misuse under the guise of benign functionality.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill includes credential-management capability despite its stated purpose being title optimization, creating a strong functionality mismatch. Even if not overtly malicious, hidden or unjustified secret-management behavior is dangerous because users may supply sensitive credentials to a tool they reasonably believe only rewrites product titles.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module and command descriptions explicitly describe generic AK configuration rather than title optimization, reinforcing that the implementation does not match the advertised skill behavior. This inconsistency is a security concern because it can conceal non-obvious capabilities and reduce the chance that users or reviewers detect sensitive operations.

Context-Inappropriate Capability

Medium

• Confidence: 64% confidence
• Finding: The skill includes capability to read environment values and modify global skill configuration, which expands its privileges beyond title rewriting. In this context, broader configuration access increases blast radius because compromise or misuse of this component can alter persistent settings and credential handling for the skill.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: Very broad trigger phrases such as generic requests to optimize or rewrite titles increase the chance of unintended invocation. In this skill, accidental invocation is more concerning because execution may lead to credential-dependent operations, external calls, telemetry, and UI flows the user did not intend to trigger.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill does not clearly warn in its primary description that every CLI execution results in telemetry being reported. Because the feature triggers on routine title-editing phrases, users may unknowingly cause outbound reporting of usage metadata, making the omission more risky than a purely internal helper.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Telemetry reporting occurs automatically and silently after command execution, without any user-facing warning in the CLI flow shown here. Even if the telemetry payload is limited, undisclosed outbound reporting undermines user trust and can create privacy and compliance issues if operational or identifying data is sent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill description says users only need to provide a product ID and broadly frames the capability as a one-click title optimization assistant, but it does not clearly constrain when the skill should be invoked. An underspecified trigger can cause the agent to activate the skill in contexts the user did not intend, which may lead to unnecessary transmission of product-related data to backend services and unexpected automated modification workflows.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The document states that the skill automatically calls an external TPP inference service and may retrieve product title, category, attributes, images, and hot-search terms, but it does not present this as a clear user-facing warning near the top of the skill. Without explicit disclosure and consent, users may unknowingly cause product data to be sent to an external service, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes fetching keyword, category, exposure, and optional LLM-backed analysis data from backend services without warning users that product metadata and custom keywords may be transmitted off-box. In a commerce workflow, that can expose business-sensitive listing information or user-provided marketing terms to external systems without informed consent or clear data-handling boundaries.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill encourages arbitrary user-supplied marketing keywords to influence title optimization without warning about policy, compliance, or listing-integrity risks. In an e-commerce context, unvetted terms such as misleading claims, prohibited promotions, or trademarked phrases could be injected into generated titles and then propagated into live listings, causing enforcement, reputational, or business damage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The markdown presents destructive or persistent actions like direct DB writes, blacklisting, and order creation as normal follow-up options without clear warning, approval gates, or safety constraints. That normalizes irreversible operations and could lead an agent or user to trigger harmful actions without understanding their consequences.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: A network call is made on every CLI execution and exceptions are silently suppressed, which reduces transparency and makes the behavior hard for users or reviewers to notice. In the context of a title-optimization skill, automatic undisclosed outbound traffic is unnecessary to core functionality and increases privacy risk.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The API key is persisted in a config file in plaintext JSON without any visible protection, encryption, or permission hardening. If the file is readable by other local users, included in backups, or exposed through other tooling, the credential can be recovered and abused.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code transmits the API key to a gateway config endpoint, and the default URL uses plain HTTP on localhost with no transport security guarantee. Even if intended for local use, sending secrets over an unauthenticated or misconfigured endpoint can leak credentials through local interception, proxying, or redirection to an attacker-controlled service.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.