Security audit

1688 Marketing

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a 1688 marketing helper, but its credential-handling and temporary callback server are broader and less contained than a user would reasonably expect.

Install only if you are comfortable giving this skill access to a 1688 merchant AK and allowing it to submit marketing enrollments after confirmation. Use it in a trusted workspace, avoid pasting AKs into chat when possible, clear stored credentials when finished, and be aware that its temporary authorization server and token fallback are broader than the documentation suggests.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The CLI exposes OAuth, token, revocation, scope-enumeration, and AK acquisition capabilities that go beyond the declared marketing-only skill purpose. This scope expansion increases the blast radius of the skill: an agent or caller expecting only marketing functions may gain credential-management primitives that can be abused to obtain or manipulate broader account access.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The interactive authorization text explicitly advertises order and product-management permissions unrelated to the stated marketing skill. That mismatch can socially engineer users or upstream agents into granting broader scopes than necessary, violating least privilege and making credential abuse more damaging if the token is later exposed.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This module parses the project-root .env and injects every key/value into process environment at import time, even though the tracker only needs three specific metadata fields. Reading broad configuration files in a telemetry helper expands access to secrets unrelated to the stated marketing purpose and increases the chance that sensitive values become available to downstream code or are later transmitted accidentally.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file implements network reporting of skill usage to a remote gateway on every CLI execution, which is outside the manifest-described marketing operations. Extra undeclared telemetry creates a privacy and trust risk, especially because it sends operational metadata without showing necessity for the core user task.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script accepts arbitrary --scope input and forwards it into OAuth authorization requests, allowing the caller to request permissions unrelated to the skill's declared marketing purpose. In an agent setting, this can enable overbroad consent prompts and privilege escalation, obtaining tokens that authorize access beyond expected 1688 marketing operations.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The command includes silent OAuth token revocation and clearing logic that is not reflected in the skill's stated marketing-focused purpose. Hidden credential-management side effects increase risk because invoking AK reset/change operations can unexpectedly invalidate user sessions or remove tokens without explicit, well-scoped user consent.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements AK setup, reset, status, and clearing behavior, which is outside the advertised scope of a marketing-operation skill. That mismatch is security-relevant because users or integrators may grant the skill trust for marketing tasks while it also handles sensitive credential state, enabling unauthorized reconfiguration, denial of service, or persistence changes if exposed through the agent.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The module and symbol names imply encrypted token storage, but the implementation writes tokens and metadata as plaintext JSON to disk. That mismatch can cause developers and operators to overtrust the storage mechanism, exposing access tokens to local users, backups, logs, or malware that can read the file.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module documentation claims only `OAUTH_1688_` token variables are updated, but `write_env` will overwrite any key provided in `updates`. If untrusted or loosely validated callers can supply arbitrary keys, they can modify unrelated configuration in `.env`, potentially altering runtime behavior, redirecting services, or weakening security settings.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The test file introduces an advertising-promotion workflow (`tool_spi_hsf_offer_ad_cpx_on`) that is not declared in the skill metadata, which creates a capability mismatch between documented scope and exercised behavior. Undeclared action-capable tooling is dangerous because it can enable execution paths reviewers, policy gates, or users do not expect, especially since the tests normalize a flow that can change ad spend settings after only conversational confirmation.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: These tests expand trigger coverage for advertising phrases such as '投放广告' even though the published trigger list in the metadata does not mention advertising. That inconsistency increases the risk of accidental or covert invocation of an undeclared monetization capability, making user intent validation and security review less reliable.

Context-Inappropriate Capability

High

Confidence: 85% confidence
Finding: The documented skill scope describes 1688 marketing features centered on activity enrollment, pricing suggestions, and opportunity recommendations, but the tests add ad campaign setup as an operational capability. Because campaign setup can directly alter spend and live promotion settings, introducing it without explicit scope justification is a material expansion from informational/recommendation tasks into account-affecting actions.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger list includes broad everyday terms such as '报名', '商机', and '查询活动', which can match user requests outside the intended 1688 context. Overbroad activation can cause the agent to invoke shell/network/file-capable tooling unexpectedly, increasing the chance of unintended API calls, credential prompts, or workflow execution in response to ambiguous language.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The intent-detection section repeats broad trigger categories with unclear boundaries, leaving substantial discretion to the agent on when to enter a sensitive workflow. In this skill, mistaken invocation is more dangerous than usual because the workflow can progress into AK retrieval, browser-based authorization, and write actions after only loosely matched user language.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: `cmd_get_token` prints a valid `access_token` to stdout, which is a sensitive secret exposure channel in agent/tooling environments where stdout may be logged, piped, stored in transcripts, or visible to other components. In a skill context, this is particularly dangerous because the manifest does not suggest raw credential handling, so downstream systems may not treat the output with the required secrecy controls.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This skill documents a state-changing external action—submitting a merchant enrollment for a marketing activity—but does not require an explicit user-facing confirmation or warning immediately before execution. In an agent setting, trigger terms like '报名' or '提报' could cause the agent to perform enrollment based on ambiguous or stale context, leading to unintended submissions, business workflow changes, or financial/operational consequences.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to query 1688 APIs using a configured AK and user/account-linked identifiers, but it does not disclose that user-provided search terms and account context may be transmitted to an external Alibaba service. This creates a privacy and consent issue because merchants may unknowingly send business-sensitive queries, category interests, and account-linked activity off-platform.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs the agent to extract an AK secret from user chat and use it operationally, but provides no safeguards about treating it as sensitive data, minimizing exposure, or avoiding logs/echoing. This creates a real credential-handling risk because secrets supplied in natural language may be retained in transcripts, command history, tool traces, or downstream logs.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation states that the AK is persisted locally in a specific file path, but it does not warn the user about credential persistence, local filesystem exposure, or the need for restrictive permissions. Storing long-lived credentials on disk without explicit security guidance increases the chance of accidental disclosure through backups, shared workspaces, or other local users/processes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Telemetry is sent on every CLI run and failures are silently ignored, but there is no user-facing disclosure in this file or indication of consent. Hidden outbound reporting reduces transparency and makes it difficult for users to assess what data leaves their environment, which is particularly concerning in automation contexts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When authentication headers cannot be built, the code still sends the scope query request unauthenticated instead of failing closed. This can cause unauthorized or unintended access patterns, leak metadata about available scopes, and weaken security assumptions by silently downgrading a protected API call without user awareness; in a marketing/admin skill, scope enumeration is more sensitive because it relates to permission boundaries.

Ssd 3

High

Confidence: 97% confidence
Finding: The agent is directed to extract a credential from conversational input and pass it into a local CLI command, which is a stronger risk than mere missing warning text. This can expose the AK through shell history, process listings, telemetry, debugging output, tool-call logs, or prompt transcripts, enabling credential theft and subsequent unauthorized access to the user's 1688 account or related APIs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/_const.py:106

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/callback_server.py:284

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/token_manager.py:53