T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_auth.py:200- Finding
Access-Key Secret Prefix Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
1688-product-element-fusion
Security checks for vulnerabilities and agentic risk
Overview
The main workflow is coherent, but bundled executable code includes unrelated template, credential, and telemetry behavior that users should review before installing.
Install only if you are comfortable with a skill package that includes unused template code, signed gateway telemetry, and a credential fallback to another 1688 skill. Prefer a revised version that removes DingTalk/template remnants, disables or discloses telemetry, and uses only credentials explicitly scoped to this skill.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/_auth.py:44- Finding
Cross-Skill Credential Access Through Global OpenClaw Configuration
- Content
View full analysis
Optional[str]: """Read AK from OPENCLAW_CONFIG_PATH as a fallback when the Gateway has not restarted.""" if not OPENCLAW_CONFIG_PATH.exists(): return None try: with open(OPENCLAW_CONFIG_PATH, "r", encoding="utf-8") as f: config = json.load(f) entries = config.get("skills", {}).get("entries", {}) skill = entries.get("1688-shopkeeper", {}) ak = skill.get("apiKey") or skill.get("env", {}).get("ALI_1688_AK", "") return ak if ak else None except Exception: return None ``` The global configuration path is constructed as follows: ```python OPENCLAW_CONFIG_PATH: Path = Path( os.environ.get("OPENCLAW_CONFIG_DIR", Path.home() / ".openclaw") ) / "openclaw.json" ``` ### Technical Analysis The audited Skill is declared as `1688-product-element-fusion`, but its authentication fallback opens the global OpenClaw configuration and explicitly retrieves credentials from the unrelated `1688-shopkeeper` Skill entry. This breaks Skill-level credential isolation. The current Skill does not need to inspect another Skill's configuration to perform visual analysis, keyword product search, or concept-image generation. If this Skill requires gateway authentication, it should receive a credential explicitly scoped to itself. The code reads the complete global configuration object before selecting the credential. Although the reviewed implementation only uses the resulting credential to sign requests to a fixed 1688 gateway, possession of another Skill's credential creates an unnecessary privilege boundary crossing and an attack-chain primitive for future, injected, or compromised capability m ...[truncated 1300 chars]- Remediation
View remediation
other
Note
- Location
cli.py:83- Finding
Undisclosed Automatic Authenticated Usage Telemetry
- Content
View full analysis
None: """ Report the Skill invocation count to the gateway. Trigger: called once whenever a CLI command completes. Failures are silently ignored and do not affect the main flow. """ try: from _http import api_post skill_name, skill_version, channel = _get_skill_env() api_post( "/api/reportSkillsUsage/1.0.0", { "apiName": None, "skillsName": skill_name, "version": skill_version, "scene": "CLI", "channel": channel, }, ) except Exception as exc: logger.debug("Telemetry reporting failed and was ignored: %s", exc) ``` ### Technical Analysis After any recognized CLI capability returns normally, `cli.py` automatically invokes telemetry. The request is sent to: ```text https://skills-gateway.1688.com/api/reportSkillsUsage/1.0.0 ``` The JSON payload contains the Skill name, version, execution scene, and release channel. No user image, prompt, product information, command name, or access-key secret is included in the reviewed payload. However, the shared HTTP client authenticates the request with the user's access-key ID and an HMAC signature. This reporting is not required for the declared product-element fusion workflow. The user-facing `SKILL.md` does not disclose the transmission or provide an opt-out. The internal telemetry doc ...[truncated 1774 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (30)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是“元素找品/元素融合创款”的设计与商品匹配能力，但提供的代码片段并未实现任何图像/视频解析、元素提取、1688 商品检索、材料工艺成本调研或概念图生成逻辑。相反，这段代码实现的是一个通用命令行调度器：扫描 capabilities 目录注册命令、分发执行对应模块，并从文档字符串和示例可见其实际关注点包括钉钉消息发送与 AK 配置。此外，代码还会在命令执行后进行使用埋点上报。这些能力与声明的核心用途明显不一致，属于主功能不匹配且包含未声明能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是面向创意设计与1688选品/创款的高层业务能力，包括图像元素提取、商品调研匹配和概念图生成。但提供的代码块完全没有任何图像处理、商品搜索、风格分析、材料/工艺/成本调研或概念图生成逻辑。相反，它专注于 API 认证基础设施：读取 AK、解析配置、构造 canonical resource、计算 MD5 与 HMAC-SHA256 签名并返回认证请求头。这类认证模块可作为某些1688相关功能的底层支持，但就该代码块本身而言，其实际行为与宣称的核心能力明显不一致，属于主目的不同的代码。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises ecommerce/design functions such as extracting creative elements from media, searching 1688 products, and generating product concept images. The actual code chunk does none of that. It merely sets constants and determines a local config file path using an environment variable and the home directory. This is materially unrelated to the declared primary purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是高层业务能力（元素找品、元素融合创款），而代码仅实现底层网络访问组件。该代码负责POST请求、签名头获取、超时/连接错误重试、HTTP状态与业务错误映射，属于通用支撑层。虽然它可能服务于1688相关能力，但单独这段代码并未体现任何所宣称的核心功能，也没有处理图片、提取设计元素、搜索商品或生成概念图。因此该代码块与声明用途存在明显的描述-行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
声明描述的是“元素找品/元素融合创款”的业务能力，涉及图像元素提取、1688商品匹配、材料工艺成本调研和概念图生成。而实际代码完全没有实现这些功能，也没有任何图像处理、商品搜索或概念设计逻辑。相反，代码的唯一目的，是在 CLI 命令执行时收集并上报技能使用信息到外部接口。这属于未在描述中声明的遥测/统计能力，且其主要用途与声明的业务功能明显不一致，因此构成明显不匹配。
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s top-level documentation and advertised commands describe a generic 1688 template with DingTalk messaging and AK configuration, which materially diverges from the manifest’s stated purpose of element-based product search and concept generation. This kind of scope mismatch is dangerous because users and reviewers may authorize or run the skill under false assumptions, enabling undisclosed messaging or credential-related behavior that expands trust and attack surface.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-open-skill-template SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-open-skill-template SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-open-skill-template SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def _load_env_file() -> None: """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。""" env_path = _ROOT_DIR / ".env" if not env_path.exists(): return with open(env_path, encoding="utf-8") as f:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares only a minimal runtime requirement (
python3) and does not scope or document tool permissions despite instructions that clearly require reading local files/images, invoking other skills, generating images, and likely accessing the network. Missing least-privilege boundaries increases the risk that the skill or any referenced implementation can access more capabilities than are necessary, making abuse or accidental data exposure harder to contain.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger list contains broad natural-language phrases such as '概念图', '创意融合', and '把XX风格用到产品上', which can cause the skill to activate in contexts the user did not intend. Over-broad invocation increases the chance of processing unrelated user content, invoking downstream procurement/image tools unexpectedly, or handling copyrighted images without deliberate consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Exposing DingTalk messaging and AK configuration capabilities is outside the declared business purpose of this skill, so it introduces hidden operational abilities that users would not reasonably expect. Even if these commands are not inherently malicious, undisclosed notification or credential-management features can be abused for data exfiltration, unauthorized messaging, or privilege expansion in a broader agent environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The CLI dynamically discovers and imports any capability module present under the local capabilities directory, then allows execution based on runtime registration. This broad plugin execution model expands functionality beyond the manifest-described scope and creates a supply-chain/code-injection risk: any added or modified local module can become an executable command without explicit allowlisting or user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The CLI reports telemetry after every command via report_skill_usage() with no visible disclosure, opt-in, or description of what data is transmitted. In a skill that already shows scope mismatch, silent telemetry is more concerning because command usage may include sensitive operational metadata or user behavior that is being exported without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file's instructional content is predominantly written in Chinese and does not indicate that users may choose another language or that the skill is intentionally region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The text states that ImageGen understands English prompts better and recommends the English version for input, effectively steering outputs toward a specific language/locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified as mandatory or users are offered a choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document describes automatic usage telemetry sent to an external gateway, including skill metadata and invocation events, but does not provide a clear privacy notice, user consent model, or operator-facing warning about outbound data transmission. Even if the payload is limited to metadata, undocumented telemetry can create compliance, transparency, and trust risks, especially in enterprise or regulated environments where outbound reporting must be disclosed and approved.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module banner and functionality are oriented around DingTalk messaging authentication, which does not align with the declared 1688 product-search and concept-generation purpose of the skill. Capability mismatch is a meaningful security signal because it may indicate hidden or undocumented messaging behavior, increasing the risk of unauthorized outbound communications or repurposing of shared credentials.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstrings and CLI/test messages are written only in Chinese, including user-facing guidance such as setup and error messages. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific audience, which conflicts with the locale-choice policy.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The fallback logic reads API credentials from a shared gateway config entry for a different skill, '1688-shopkeeper'. This creates cross-skill credential access and breaks isolation boundaries, allowing this skill to function with another skill's secrets and potentially abuse permissions not intended for it.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This file contains natural-language documentation exclusively in Chinese, including the module docstring and inline descriptions. The policy explicitly calls for flagging language or locale constraints when a skill forces a specific language without opt-in, and no user choice or justification is present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This file reports telemetry to a remote gateway on every CLI execution, but that behavior is not necessary for the stated product-search/product-concept functionality. Undisclosed network beacons create a privacy and software-integrity concern because usage metadata is transmitted automatically and failures are intentionally hidden from the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Telemetry is sent on every CLI command without any visible notice, consent flow, or local indication in this file. Silent background reporting undermines user expectations and can expose usage patterns to a remote service, especially because exceptions are swallowed and the behavior is easy to miss during review or operation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill content, prompts, confirmations, and required output text are all specified only in Chinese, and no opt-in or language selection is offered to the user. Under the policy, forcing a specific language without user choice can be a natural-language locale policy issue unless clearly justified as region-specific.
- Content
Static analysis
No suspicious patterns detected.