1688-shop-crm-customer-filter

• Outcome: Review
• Latest audit: Sep 4, 2026 · 2:59 AM UTC
• Version: 0.47.0

Overview

The skill mostly matches its 1688 CRM purpose, but it automatically reports usage metadata and reads credential/config sources without clear main-document disclosure.

Review before installing. This skill needs access to a 1688 account credential and can read CRM customer data and create custom customer attributes. It also automatically reports command usage metadata to the 1688 gateway and may read local OpenClaw configuration or .env values for credentials/metadata, so install it only in an environment where that reporting and credential scope are acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is for a business-facing CRM customer screening skill. However, the supplied code chunk contains only infrastructure utilities for standardized JSON output and error handling. It does not access customer data, apply filters, perform sorting/pagination/statistics, or manage custom attributes. This is a material description-behavior mismatch because the actual code serves a generic support role rather than implementing the declared CRM functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 代码的实际用途与声明的客户筛选 CRM 功能明显不符。声明强调的是客户列表筛选、排序、分页、统计和自定义属性管理，但代码片段仅实现了调用埋点/遥测上报逻辑，没有任何客户查询、筛选、排序、分页、统计或字段管理相关行为。它还访问了未在描述中提及的资源：本地 .env 配置和远程上报 API。这属于与声明主功能 materially different 的行为，应判定为描述与代码不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: 声明描述的核心能力是“筛选客户/查找客户/客户列表”等面向客户数据的操作，并且还包括排序、分页、统计以及新增自定义属性。实际代码的 COMMAND_DESC 明确为“获取当前商家可用的筛选维度”，调用的是 customer_field_config()，处理的返回内容是 activeAttrs 和 filterableTags，即筛选字段元数据与标签配置。代码仅对这些配置项进行规范化、去重、字段裁剪和展示输出，没有接收筛选条件、没有拉取客户列表、没有执行任何筛选、排序、分页或统计逻辑，也没有新增字段的写操作。因此该代码与声明用途存在明显的功能层级偏差：它更像是“查看可用筛选字段配置”的子能力，而不是完整的 CRM 客户智能筛选 Skill。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: 从代码看，主功能是 `alibaba.1688.customer.list`，即分页查询客户列表，支持 filters、sorts、page_num、page_size，并输出列表及统计信息。这与描述中的“筛选客户、查找客户、客户列表、询盘未转化/未成交、有成交客户”等查询筛选能力基本一致。代码还对字段做了重命名、去噪、手机号隐藏和 markdown 渲染，这些都属于展示与合规处理，不构成额外风险能力。 但描述还宣称支持“查看和新增自定义属性”。在这段代码中，没有任何用于查询字段配置、获取自定义属性定义、创建字段、写入字段配置或调用相应新增属性接口的实现；只是在客户返回结果中读取 `extraAttrs` 进行展示。因此，声明覆盖了超出该代码片段实际提供的能力，属于描述与行为不完全一致的情况。

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-crm-customer-filter
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-crm-customer-filter
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-crm-customer-filter
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_file() -> None:
    """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""
    env_path = _ROOT_DIR / ".env"
    if not env_path.exists():
        return
    with open(env_path, encoding="utf-8") as f:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: L006 中的“帮我找客户”“我的客户”等短语过于通用，容易与普通对话或其他客户相关技能的自然表达重叠。该文件虽列出了触发词，但没有提供排除条件或更严格的上下文约束来界定何时应激活此技能。

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The CLI unconditionally invokes telemetry reporting after every command, even though telemetry collection is not part of the stated customer-filtering functionality and there is no evidence here of user consent or minimization. This creates a hidden data-exfiltration surface: command usage, timing, environment-derived identifiers, or other metadata could be sent externally via `_tracker.report_skill_usage()`, and exceptions are suppressed so the behavior is hard to detect or audit.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Usage telemetry is executed after every command without any user-facing notice in this file, which is a privacy and transparency failure. In a CRM-related skill, even 'usage-only' telemetry can reveal sensitive business activity patterns such as customer-query frequency, operational timing, and command usage, and the silent exception handling further reduces visibility into the behavior.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: This markdown file documents that `ALI_1688_AK` is automatically injected, which indicates the skill accesses sensitive credentials. The description does not include any warning about credential use, privacy implications, or precautions for handling environment-provided secrets.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation describes a built-in telemetry mechanism that reports skill usage to a remote gateway, which is outside the user-visible CRM customer filtering purpose stated in the manifest. Even if only metadata is sent, undisclosed network reporting expands the skill's effective behavior and can create privacy, compliance, and trust risks because operators may not expect customer-filtering tooling to phone home.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file documents outbound telemetry and environment-variable-based metadata collection, but it does not present a clear user-facing warning or privacy notice about what data is transmitted and under what conditions. In a CRM-related skill, even usage metadata can be sensitive because it reveals operational patterns, deployment context, and authenticated service usage that users may not expect to be shared.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The markdown describes HTTP POST telemetry reporting to an external gateway using the same authentication context as business APIs, but this capability is not justified by the stated CRM filtering purpose. Undisclosed outbound reporting can create an unnecessary data flow, increase attack surface, and complicate compliance review, especially when tied to authenticated infrastructure.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This code reads an access key from both the ALI_1688_AK environment variable and a local config file, which is sensitive credential access. While there are internal docstrings, there is no user-facing warning, confirmation, or visible disclosure in this file that the skill will read credentials from the runtime environment or fallback config.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This Python file contains natural-language documentation and operational messages entirely in Chinese, including the module docstring and later user-visible exceptions/logs. The policy requires not forcing a specific language or locale unless there is explicit opt-in or a clearly justified region-specific constraint, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains natural-language strings in Chinese in the module docstring, class docstring, and error output. Under the policy, forcing a specific language without user opt-in or a clearly justified locale constraint is a natural-language policy violation.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The manifest describes a CRM customer filtering skill with capabilities around querying, sorting, statistics, and custom attributes. This file instead loads configuration from a local .env file and sends usage telemetry to a gateway on every CLI invocation, which is not justified by the stated end-user purpose of filtering customers.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends usage data to a gateway on every CLI command execution via `api_post`, but the behavior is only described in an internal docstring and there is no confirmation prompt, print/log disclosure to the user, or other visible notice in this file. For code files, network calls that transmit user or system data should have some form of user disclosure unless clearly surfaced elsewhere.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The user-facing docstring and command description are written only in Chinese, which imposes a language choice in natural-language strings without offering any alternative or opt-in. Under the policy, locale or language restrictions should be optional or clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The module and function docstrings are written only in Chinese, which imposes a specific language context without any indication of user opt-in or justification for a locale restriction. The policy for natural-language content requires avoiding forced language/locale constraints unless they are explicitly optional or clearly justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This Python file sends data to a remote API via `api_post`, transmitting user-supplied attribute fields and possibly a value, but the file contains no confirmation prompt, logging, or comment/docstring warning about the outbound network action. For code files, network calls that transmit user or system data should have some visible disclosure unless clearly communicated elsewhere.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The only natural-language descriptions in the file are in Chinese, with no indication that the skill supports user language choice or that a Chinese-only locale is required. This can violate language/locale policy when a specific language is imposed without opt-in or documented justification.

Static analysis

No suspicious patterns detected.