ClawHub
Back to skill

Security audit

1688-shop-health-check

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real 1688 shop health-check skill, but it needs Review because it can store API keys, install packages automatically, create scheduled tasks, and execute other skills with broad scope.

Before installing, confirm you are comfortable giving this skill access to 1688 shop/business data and storing a 1688 AK in OpenClaw config. Use it in an environment where automatic package installation is acceptable or disabled, review any follow-up action card before confirming, and only enable the daily scheduled task if recurring automatic shop diagnostics are intended.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (121)

Tainted flow: 'gateway_url' from os.environ.get (line 32, credential/environment) → requests.patch (network output)

Critical
Category
Data Flow
Content
headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description presents an end-user business diagnostic workflow for 1688 shops. In contrast, the supplied code only provides low-level authentication utilities: retrieving AK credentials, optionally from a config file fallback, generating content MD5 values, canonicalizing query strings, and producing signed headers for authenticated API requests. While such auth code could be a supporting component of the larger skill, this chunk by itself does not implement the described health-check behavior. Because the evaluation asks whether the description accurately represents what the supplied code chunk actually does, this is a mismatch: the actual code’s purpose is API authentication/signing, not business health analysis or report generation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
描述中的核心能力是店铺经营健康检查与报告生成，而代码实际仅实现调用埋点统计，属于完全不同的主要目的。该脚本还执行了未在声明中提及的本地配置读取和外部上报行为。根据评估标准，这既是‘主要目的 materially different’，也是‘undeclared capability’与‘unrelated trigger’，因此应判定为明显不匹配。

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
声明描述的是一个面向 1688 店铺经营分析的诊断型 Skill，核心能力应围绕流量、询盘、成交、商品、客户、广告、风险等业务数据进行分析并产出报告。而提供的代码与这些功能完全无关，它只是一个命令行配置入口，负责查看 AK 配置状态、校验 AK、将 AK 写入 gateway 或配置文件，并提示重新加载配置。其主要目的属于凭证管理/环境配置，而非店铺体检。尽管配置 AK 可能是某些 1688 能力的前置步骤，但这段代码本身并未执行任何诊断、分析、报告生成或交互流程，因此与声明用途存在明显且实质性的描述-行为不一致。

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description presents an operational analytics/diagnostics skill for 1688 shop health checks, including report generation and workflow-driven business analysis. The actual code chunk does not implement any shop diagnosis, reporting, seven-dimension analysis, action recommendations, or scheduling. Instead, it implements credential configuration plumbing: validating an access key, persisting it via a gateway API or local JSON config, and checking existing configuration from environment variables or files. These are materially different capabilities from the declared end-user purpose. While such setup code could support the skill, this chunk itself performs undeclared sensitive configuration and credential-handling behavior rather than the described health-check functionality.

Ae1

High
Category
analysis-evasion
Content
> **执行模型**：店铺体检全流程（意图确认 → 七维度并行取数 → 分析结论 → HTML 报告 → 行动项选择）已由 `workflow/health-check.js` 编排覆盖，命中 workflow whenToUse 时直接执行 workflow，不加载本 SKILL.md。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Context-Inappropriate Capability

High
Confidence
93% confidence
Finding
这里不仅让技能输出建议，还要求它根据行动项动态匹配当前会话中的其他技能并立即执行。这使该技能具备了通用代理/编排能力，而不是局限于店铺体检分析，和其声明的专业诊断用途相比能力过宽。

Ae1

High
Category
analysis-evasion
Content
- **实现位置**：`scripts/_tracker.py` → `report_skill_usage()`，在 `cli.py` 的 `main()` 中每次命令执行后自动调用
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- **实现位置**：`scripts/_tracker.py` → `report_skill_usage()`，在 `cli.py` 的 `main()` 中每次命令执行后自动调用
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-health-check
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-health-check
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
职责：每次 CLI 命令执行时，向 skill 网关上报一次调用记录，用于统计 skill 调用次数。
上报失败不影响主流程，静默处理。

环境变量（从项目根目录 .env 读取）：
    SKILL_NAME     skill 名称，默认 1688-shop-health-check
    SKILL_VERSION  skill 版本，默认 1.0.0
    SKILL_CHANNEL  发布渠道，默认 clawhubai
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
def _load_env_file() -> None:
    """解析项目根目录的 .env 文件，将变量注入 os.environ（已有环境变量不覆盖）。"""
    env_path = _ROOT_DIR / ".env"
    if not env_path.exists():
        return
    with open(env_path, encoding="utf-8") as f:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest describes a shop health check skill covering seven diagnostic dimensions, summary conclusions, HTML reports, follow-up action cards, and scheduled health-check guidance. This file instead exposes a CLI for querying a seller's top-performing products by metrics like成交/流量/拉新/复购, which is a different analytics capability and does not implement the declared health-check workflow behavior.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The manifest and code metadata describe a diagnostic workflow that analyzes shop data and produces conclusions, reports, and follow-up action guidance. However, runScript automatically invokes `python3 -m pip install` on missing modules, which mutates the runtime environment and goes beyond expected read-only health-check behavior.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
A business health-check skill is justified in reading shop data, generating reports, and possibly invoking downstream reporting/scheduling tools. Spawning shell commands to install arbitrary Python packages inferred from stderr is a host-maintenance capability unrelated to the user-facing purpose of store diagnostics.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The batch-fetch path is still part of the health-check workflow, but it similarly detects `ModuleNotFoundError` and runs `pip install` before retrying. This behavior changes the host environment and is not disclosed in the skill's stated purpose, which focuses on diagnosis, HTML reporting, action selection, and scheduling.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
In the batch execution path, the workflow again escalates from data retrieval to environment maintenance by installing missing modules. That capability is not a direct requirement of producing a shop health report and is not explicitly part of the skill's advertised scope.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
Manifest描述主要聚焦于七维度店铺体检、输出结论与HTML报告，但这里进一步要求在体检后根据用户勾选“继续执行对应优化动作”以及创建或重新启用定时任务。该行为不再只是分析诊断，而是进入后续运营执行与自动化配置，属于功能范围扩张。

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
文档要求先检查Schedule任务列表，再根据命中情况决定新建或重新启用“店铺健康检查”定时任务。这是任务调度与状态管理能力，不是完成一次店铺健康诊断所必需的直接能力，且涉及持久化自动执行。

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
L041-L042 明确要求“所有输出必须使用中文”，并禁止英文表达，这是对语言/locale 的硬性限制。根据规则，若未提供用户语言选择或未说明这是特定地区合规/业务必须要求，则属于自然语言政策违规。

Missing User Warnings

Medium
Confidence
84% confidence
Finding
L110 标注 `configure` 会“写入本地配置”，L579-L585 进一步指导用户输入 AK，但文档未提醒这是敏感凭证、应妥善保管，亦未说明存储位置/风险边界。对于涉及敏感凭证访问与持久化的行为，缺少任何用户警示。

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
此处明确要求对用户勾选的每一项行动项“现场寻找”可承接技能，读取目标技能SKILL.md并真实执行。这意味着该技能不仅生成体检报告，还充当后续自动化编排器去触发其他业务能力，与manifest对“健康检查”技能的核心定位不完全一致。

Missing User Warnings

Medium
Confidence
92% confidence
Finding
L657-L661 说明每次 CLI 命令执行都会自动向技能网关发送调用记录，这是网络传输行为，且可能包含用户/系统使用元数据。文档未向用户说明会上报哪些内容、目的为何、是否包含店铺或请求信息，缺少隐私与网络传输警示。

Static analysis

No suspicious patterns detected.