Security audit

1688-product-element-fusion

Security checks for vulnerabilities and agentic risk

Overview

The creative product-design workflow is plausible, but the package also ships unrelated executable 1688/DingTalk template code that can read shared credentials and silently report CLI usage.

Review this before installing. The main design workflow may be useful, but the package should be cleaned up or explained: remove unrelated DingTalk/template scripts, avoid reading credentials from another skill’s config, and clearly disclose or disable telemetry. Treat generated images, prompts, source links, and element JSON as local files that may persist after use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The module advertises itself as a DingTalk messaging authentication component, while the skill metadata describes a 1688 product search/design skill. This capability mismatch is dangerous because it indicates hidden or undeclared functionality, which can enable unauthorized outbound messaging or cross-purpose API access beyond user expectations. The hardcoded fallback to a different skill entry name further increases suspicion that this code was copied or repurposed without proper isolation.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The code reads credentials from a shared environment variable and a global config file fallback, including looking up the entry for a different skill ("1688-shopkeeper"). In a multi-skill environment, this creates a cross-skill secret access path that can let this skill use credentials unrelated to its declared workflow, violating least privilege and increasing the chance of credential confusion or misuse.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file performs outbound telemetry on every CLI invocation even though the stated skill purpose is product search/design, not analytics. Because the reporting is automatic and silent, it creates undisclosed data flow to a remote gateway and expands the attack/privacy surface beyond what users would reasonably expect from this skill.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The code reads the project .env file at import time to populate environment variables for tracking metadata, even though this skill's core functionality does not require environment inspection. Parsing .env broadly increases exposure to secrets and can unintentionally normalize access to sensitive local configuration.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger list is very broad and includes common creative phrases such as '概念图', '创意融合', and '把XX风格用到产品上', which can cause the skill to activate in contexts the user did not intend. Unintended activation can route user images, product ideas, or links into external processing flows, increasing privacy and safety risk even without explicit malicious logic.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The instructions require saving outputs to the outputs directory but do not clearly warn the user that files will be written locally. Silent local persistence can surprise users, create residual sensitive data on disk, and expose concept art, prompts, or source links to other local users or processes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The CLI reports telemetry after every command via _tracker.report_skill_usage() without any visible notice, consent, or ability to opt out in this file. In a skill whose declared purpose is product search and concept generation, undisclosed usage reporting is outside expected functionality and can leak sensitive operational metadata such as command invocation patterns, identifiers, or business activity.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly describes automatic telemetry submission to an external 1688 gateway after CLI command execution, including skill name, version, scene, and channel, but it is framed as implementation guidance rather than a clear user-facing disclosure or consent mechanism. In a skill context, silent outbound reporting is security-relevant because operators may not realize command usage metadata leaves their environment, which can create privacy, compliance, and trust issues even if the payload is limited.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Telemetry is sent over the network silently and failures are suppressed, so users receive no disclosure that a remote report occurs on each command. This undermines informed consent and makes unexpected data exfiltration harder to notice or audit.

Static analysis

No suspicious patterns detected.