1688-product-to-ozon

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:29 AM UTC
• Version: 1.2.1

Overview

The skill mostly fits an Ozon listing workflow, but it needs review because it can make live marketplace changes and includes an unsafe batch script that can trigger paid AlphaShop requests without clear user control.

Review before installing. Use it only with credentials and products you are comfortable sending to Ozon and AlphaShop, add an explicit confirmation or dry-run before upload, and remove or guard batch_translate.py so imports cannot consume paid API quota or write files unexpectedly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_translate.py:5
• Finding: Hardcoded paid third-party batch operations execute during module import<![CDATA[ ## Vulnerability Details **File Location**: `scripts/batch_translate.py:5-46` **Vulnerability Type**: Import-time network side effects and uncontrolled paid API consumption **Risk Level**: Medium ### Vulnerable Code ```python from translate_images import translate_image urls = [ 'https://cbu01.alicdn.com/img/ibank/O1CN0109gRVx1zPrBVAmA6p_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01K6soO11zPrSIDwxDA_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01FPl3Ww1zPrBZrq6Qt_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01Fo2kfn1zPrSDKGyfp_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01mn8R421zPrBZrpMgp_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN0128EvSg1zPrBTQA6h4_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01rSlKS41zPrBOldjcv_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01NtcwD91zPrBXrFHQA_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01YDv2CS1zPrBR0gXFI_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01FXDAa91zPrBTIuEYo_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN013hqQWq1zPrGIuflsk_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01UNFELq1zPrBbtYLSc_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01utZt1WPrRZQcrQH_!!1741586707-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01XT6mBF1EPbJJqGnya_!!2208893230344-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01yLeygD1EPbJOlW87Z_!!2208893230344-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN0127eQmd1EPbJQWO5e4_!!2208893230344-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01pUTHHG1EPbJREDKSL_!!2208893230344-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01tCd6TV1EPbJJqLu8a_!!2208893230344-0-cib.jpg', 'https://cbu01.alicdn.com/img/ibank/O1CN01wEiMEP1EPbJPqhUSP_!!2208893230344-0-cib.j ...[truncated 3211 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Move all operational logic into an explicit `main()` function and protect it with: ```python if __name__ == "__main__": main() ``` 2. Remove hardcoded production image URLs. Accept URLs explicitly through validated command-line arguments, standard input, or a caller-provided product-data file. 3. Require explicit confirmation before initiating a large or paid translation batch, and display the number of requests that will be made. 4. Enforce a reasonable maximum batch size and provide rate limiting or quota controls. 5. Validate accepted URLs, require HTTPS, and consider an allowlist of expected image-host domains. 6. Write output under the documented `tmp/` directory using a caller-selected or collision-resistant filename. 7. Refuse to overwrite an existing output file unless the caller explicitly enables replacement. 8. Keep the module free of network and filesystem side effects during import so it can be safely inspected, tested, and reused. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Credential-handling dependencies are installed through unbounded version ranges<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2` **Vulnerability Type**: Non-reproducible and insufficiently constrained third-party dependencies **Risk Level**: Low ### Vulnerable Code ```text requests>=2.20.0 PyJWT>=2.0.0 ``` ### Technical Analysis The dependency declarations specify only minimum versions and have no upper bounds, exact pins, lock file, or package hashes. A future installation can therefore resolve to versions that were not reviewed with this Skill. This is security-relevant because `requests` handles all credential-bearing HTTPS calls, while `PyJWT` generates the AlphaShop authentication tokens. The declarations do not themselves prove that either package is malicious; the risk is that installations are not reproducible and automatically trust future releases or a compromised package distribution path. The package names are legitimate and no dependency-confusion or typosquatting package was identified. Therefore, this finding is limited to dependency hardening and supply-chain exposure rather than a confirmed malicious dependency. ### Attack Path 1. A user or deployment process installs the project dependencies at a later date. 2. The package resolver selects the newest versions satisfying the open-ended `>=` constraints. 3. The selected releases differ from those originally reviewed and may contain a vulnerability, incompatible security behavior, or—if the upstream distribution channel is compromised—malicious code. 4. The packages execute in the Skill process with access to its environment. 5. Because the process contains Ozon and AlphaShop credentials, a compromised dependency could read those values or intercept authenticated API requests. This path requires a vulnerable or compromised future dependency release or package distribution channel; the current manifest alone does not establish active compromise. ### Impact Assessment - **Affected privileges:** The privileges of the Python process running ...[truncated 638 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin dependencies to exact versions that have been reviewed and tested: ```text requests==<reviewed-version> PyJWT==<reviewed-version> ``` 2. Generate and commit a reproducible lock file containing transitive dependencies. 3. Use package hashes, such as `pip --require-hashes`, to verify downloaded artifacts. 4. Install only from an approved package index over authenticated HTTPS. 5. Add automated dependency vulnerability scanning and review alerts. 6. Test and review dependency upgrades before changing pinned versions. 7. Run the Skill in an isolated environment with access only to the credentials and files required for the current operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (46)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的核心能力是将 1688 商品上架到 Ozon，并通过 Ozon API 执行商品上传与状态查询；但提供的代码仅执行图片 URL 的批量翻译处理，调用 `translate_image` 获取翻译后的图片地址，并将结果写入本地 JSON 文件。代码中没有任何与 Ozon、商品上架、商品属性构造、库存/价格上传、状态查询相关的实现，也没有体现“单个商品铺货”的流程。因此该代码片段与声明用途存在明显且实质性的不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个将 1688 商品上架到 Ozon 的完整技能，至少应包含 1688 商品数据获取、向 Ozon 提交商品导入/上传请求，以及可能的状态查询。实际代码片段只实现了“状态查询”这一子功能：它接收 task_id，调用 Ozon API 查询导入任务结果，并输出 imported/failed 状态。代码没有任何 1688 相关逻辑，也没有执行商品上传或创建导入任务。因此，实际行为仅覆盖声明中的一小部分，且主用途更接近‘Ozon 上传任务状态查询器’，与宣称的‘1688 商品铺货到 Ozon（上架）’存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的是一个完整的“将1688商品铺货到Ozon并上架”的技能，核心能力应至少包括获取1688商品信息、构造Ozon商品数据并调用上传接口，以及可选的状态查询。实际代码只是在已有 task_id 的前提下，使用Ozon API查询导入任务状态并打印结果。它没有访问1688资源，没有上传商品到Ozon，也没有执行商品上架流程。因此代码行为只匹配声明中的“状态查询”部分，而不匹配其主要宣称的“1688到Ozon商品铺货/上传上架”能力，属于实质性描述不符。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的核心能力是把1688商品上架到Ozon，并通过Ozon官方API进行商品上传和状态查询。但代码中唯一实际行为是接收一个1688类目ID，生成 AlphaShop 的JWT认证令牌，然后请求 AlphaShop 的类目映射接口 `alphashop.openclaw.offer.cate.ozon.query` 来查询1688到Ozon的类目对应关系。代码没有商品数据处理、没有创建/上传商品、没有调用Ozon官方API、也没有查询商品上架状态。因此其实际用途与声明的主要目的存在明显且实质性的偏差。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个商品铺货/上架能力：把1688商品发布到 Ozon，并查询上架状态。但代码内容是一个独立的查询工具，功能集中在 Ozon 类目属性字典值的搜索与列表获取，调用的是 /v1/description-category/attribute/values/search 和 /v1/description-category/attribute/values 接口。代码没有任何1688侧数据获取逻辑，也没有商品创建、更新、提交发布、状态轮询等与上架流程直接对应的 API 调用。因此该代码块的实际行为与声明的主要用途存在明显且实质性的不一致。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的核心能力是把1688商品上架到Ozon，并通过官方API进行商品信息上传和状态查询。但代码实际只读取OZON_API_KEY和OZON_CLIENT_ID，从/v1/description-category/attribute接口查询Ozon类目的属性要求，输入也是external_category_id映射出的两个类目ID，而不是商品数据。代码中没有任何商品创建、商品内容上传、库存价格设置、发布上架或状态查询相关逻辑。因此其主要用途与声明明显不符，属于实质性能力不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个电商铺货/上架能力：把 1688 商品发布到 Ozon，并支持上传商品信息与查询状态。但代码实际只做一件事：接收图片 URL，使用环境变量中的 AlphaShop 凭证生成 JWT，然后请求 AlphaShop 图片翻译接口，将图片文字翻译为俄语。代码中没有任何与 1688 商品采集、商品字段构建、Ozon API 调用、商品创建/更新、上架、或状态查询相关的逻辑。其主要目的、外部服务、输入输出和能力都与声明严重不符，因此应判定为明显不匹配。

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file’s functionality materially diverges from the declared skill purpose: instead of listing 1688 products to Ozon via the Ozon API, it sends user-supplied image URLs to an unrelated AlphaShop image translation service. This mismatch is dangerous because it expands data flows and capabilities beyond what a user or reviewer would reasonably expect, increasing the risk of undisclosed third-party data transfer and supply-chain trust violations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises automatic image translation and one-click product upload but does not clearly warn that product images and metadata will be transmitted to external services such as AlphaShop and Ozon, nor that marketplace listings may be created or modified as a side effect. In an automation skill handling commercial assets, missing disclosure increases the chance of unintended data exposure and accidental publication.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The documentation states that images must be translated to Russian before upload, presenting the transformation as mandatory without documenting user choice, exceptions, or privacy/compliance considerations. This can pressure users into sending image content to external translation services even when unnecessary, inappropriate, or disallowed for certain products.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents access to environment secrets, local file writes, and outbound network calls, but does not declare any tool scope or allowed-tools constraints. This weakens least-privilege controls and can let an agent invoke capabilities broader than users expect, especially when handling API keys and third-party requests.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest presents the skill as a simple Ozon listing tool, while the documented workflow also sends product images to a third-party service and writes intermediate files locally. This incomplete disclosure can cause users to provide credentials or product data without realizing it will be shared externally and stored on disk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase '铺货' is overly broad and may activate the skill in contexts unrelated to Ozon listing. Over-broad invocation increases the chance that networked actions, credential use, or third-party transmission occur when the user intended a more generic conversation or another workflow.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file repeatedly mandates that titles and non-numeric values be translated into Russian, and later fixes the image-translation target language to Russian. This is a natural-language locale constraint with no user choice or explicit policy justification in the skill instructions.

External Transmission

Medium

• Category: Data Exfiltration

Content

**认证：** 需要环境变量 `ALPHASHOP_ACCESS_KEY` 和 `ALPHASHOP_SECRET_KEY`。

**脚本说明：**
- 调用 AlphaShop 图片翻译PRO接口（`POST https://api.alphashop.cn/ai.image.translateImagePro/1.0`）
- 源语种自动识别（auto），目标语种固定为俄语（ru）
- 认证方式：JWT HS256 签名（`iss=AK, exp=now+1800, nbf=now-5`，SK 为密钥）
- 输出 JSON 格式，包含每张图片的原始URL和翻译后URL

• Confidence: 93% confidence
• Finding: The skill sends product images and related data to AlphaShop, a third-party external service, using environment-based credentials. External transmission is risky here because marketplace product assets may contain proprietary, sensitive, or regulated content, and the manifest does not prominently foreground this transfer at the top level.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest describes a skill for listing a single 1688 product on Ozon and querying Ozon upload status. This file instead processes a hardcoded batch of product image URLs, invokes an image-translation routine for each, and writes translated image mappings to a local JSON file; no Ozon API interaction or product-listing logic appears here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language descriptions and console messages exclusively in Chinese, beginning with the module docstring and continuing throughout execution. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and all user-facing messages in this script are written only in Chinese, which imposes a specific language on users without offering any language or locale choice. This matches the policy category for language or locale constraints that are not optional or justified as region-specific UX requirements.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script behavior does not match the skill manifest: it queries category mapping through AlphaShop instead of uploading/listing products to Ozon or checking listing status via the claimed official Ozon API. This kind of capability mismatch is dangerous because it can mislead operators about what external services are contacted and what data is processed, undermining trust, review, and permission boundaries.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains natural-language instructions and runtime messages exclusively in Chinese, starting with the module docstring and continuing throughout error/log output. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is clearly documented and justified.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly says the capability is implemented through AlphaShop API, which contradicts the manifest's claim of using the official Ozon API. This inconsistency can conceal third-party data sharing and cause reviewers or users to approve a skill under false assumptions about where credentials and business data are sent.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# === 常量 ===
API_URL = "https://api.alphashop.cn/alphashop.openclaw.offer.cate.ozon.query/1.0"


def log(msg: str, level: str = "INFO"):

• Confidence: 93% confidence
• Finding: The script transmits data and a bearer token to an external third-party endpoint at api.alphashop.cn. In this skill context, that is more dangerous because the manifest suggests official Ozon API usage, so users may not expect secrets, category data, or operational metadata to be sent to an intermediary service.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: All user-facing natural-language instructions, descriptions, and error/help text in this file are in Chinese, with no opt-in or alternative language path. That can violate language/locale policy when a specific language is effectively forced on users without explicit choice or justification.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says the skill is for publishing a 1688 product to Ozon and querying upload status, implying product-listing operations. This file's docstring and implementation only fetch category attribute requirements from Ozon's description-category API, which is a preparatory taxonomy lookup and not product upload or status-query behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""获取Ozon类目下的属性要求"""
    log(f"获取Ozon类目属性: description_category_id={desc_cat_id}, type_id={type_id}")
    try:
        resp = requests.post(
            OZON_CATEGORY_ATTRIBUTES_URL,
            headers={
                "Client-Id": client_id,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.