T09 · Insecure Skill Coding Practices
Warning
- Location
cli.py:60- Finding
AK Credential Stored in Plaintext Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
1688 Shop Freedom Query Data
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it handles merchant API credentials and exported business data with weaker scoping and disclosure than users should accept blindly.
Review before installing. Use this only if you are comfortable storing a 1688 merchant AK locally in OpenClaw configuration, and avoid invoking the configure capability through an untrusted OPENCLAW_GATEWAY_URL. Treat generated HTML or Excel outputs as sensitive business files, and be cautious about the visualization option because it may hand query results to another installed skill.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/capabilities/configure/service.py:34- Finding
Full AK Credential Can Be Transmitted to an Unrestricted Environment-Controlled URL
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)
Tainted flow: 'gateway_url' from os.environ.get (line 34, credential/environment) → requests.patch (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The code takes OPENCLAW_GATEWAY_URL directly from the environment and sends the supplied API key to that endpoint without validating the scheme, host, or trust boundary. An attacker who can influence environment variables or the runtime context can redirect the secret-bearing PATCH request to an attacker-controlled server, causing credential exfiltration; the default use of plain HTTP also weakens transport security.
- Content
python headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5) return resp.ok except Exception:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-freedom-query-merchant-data SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-freedom-query-merchant-data SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。 上报失败不影响主流程，静默处理。 环境变量（从项目根目录 .env 读取）： SKILL_NAME skill 名称，默认 1688-freedom-query-merchant-data SKILL_VERSION skill 版本，默认 1.0.0 SKILL_CHANNEL 发布渠道，默认 clawhub
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def _load_env_file() -> None: """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。""" env_path = _ROOT_DIR / ".env" if not env_path.exists(): return with open(env_path, encoding="utf-8") as f:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities to read environment/configuration, access the network, and write local files, but it declares no explicit tool scope or permission boundaries. In an agent setting, missing allowlists increases the chance of unintended tool use, broader-than-necessary access, and abuse of AK/configuration or exported merchant data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The AK configuration flow asks users to provide credentials but does not warn that the credential may be stored locally. Silent local persistence of API keys materially increases the risk of credential theft from disk, accidental inclusion in backups, or reuse by other local processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages direct execution of data-query commands without clearly warning that merchant operational data will be transmitted to external or gateway APIs. In a business-data context, this can expose sensitive commercial metrics without sufficient user awareness or consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow extends beyond querying/interpretation into HTML generation and Excel export, which introduces local data persistence and possible sharing of merchant data. Because these side effects are outside the stated purpose, users may not anticipate that sensitive business data will be written to disk or transformed into distributable artifacts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill can invoke other skills and generate local files even though its stated purpose is merchant data querying. Cross-skill invocation can exfiltrate or over-share merchant data to less-trusted components, and local file generation creates durable copies that may be accessible beyond the current session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Exporting merchant data to Excel in a local outputs directory creates a durable copy of potentially sensitive business information without an upfront warning. This increases the risk of unauthorized access, accidental sharing, or retention beyond the user's intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The rule
中文输出requires the final answer to be in Chinese and forbids English metric names, which imposes a fixed language choice. This is a natural-language policy issue because the skill does not offer the user any language preference or document a justified region-specific language constraint.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code dynamically enumerates subdirectories under scripts/capabilities and imports any cmd.py it finds, which creates a broad execution surface beyond the narrow declared purpose of querying shop data. If an attacker can place or modify files in that directory or influence the package contents, arbitrary capability code can be executed simply by invoking the CLI or viewing usage information.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The CLI implements local API key configuration and persistence even though the skill’s stated purpose is shop-data querying and interpretation. This expands the skill’s privileges and data-handling scope, and storing credentials in a local JSON config without stronger protections increases the chance of accidental disclosure via weak file permissions, backups, or other local access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The configure command writes the provided API key directly into a local config file without any prior user-facing warning that the secret will be persisted on disk. This can surprise users into exposing credentials through shared machines, source-control mistakes, backups, or permissive filesystem settings, especially since the file path is treated as routine configuration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file explicitly offers actions that produce output artifacts affecting user data: an interactive HTML dashboard and a structured Excel export. Under the markdown-specific warning criterion, the description should warn users about data export/file generation implications, but these options are presented without any caution about where data goes, what files are created, or potential sensitivity of exported content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The only natural-language documentation in this file is written in Chinese, with no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in or documented justification is a locale/language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This Python file contains user-facing docstrings and error messages exclusively in Chinese, including the module description and all runtime output text. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified regional limitation, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This module reads the project-root .env file and injects its contents into process environment variables even though the stated skill purpose is shop data querying, not local configuration harvesting. While the code only appears to use three expected keys afterward, the blanket parsing of .env expands the skill's access to potentially sensitive local data and creates an unnecessary trust boundary violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file performs outbound usage telemetry to a gateway on every CLI invocation, which is outside the described behavior of converting natural-language shop questions into API calls and interpretations. Undisclosed telemetry is dangerous because it adds unexpected network-side data sharing and creates a channel that can be extended to transmit more than minimal usage metadata.
- Content