1688 Shop Zkt Buyer Manage

• Outcome: Review
• Latest audit: May 28, 2026 · 8:22 AM UTC
• Version: 0.1.0

Overview

This skill mostly does what it claims, but it handles 1688 account credentials and detailed customer data with weak disclosure, unsafe secret setup, and automatic telemetry.

Install only if you are authorized to use the 1688 account and customer data exposed by the AK. Treat the AK, buyer identifiers, customer profiles, and purchase metrics as sensitive, and review whether automatic usage reporting and local credential persistence are acceptable in your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet the specification clearly relies on environment access (`ACCESS_KEY`), file reads/writes (`.env`, configuration), and network calls to backend services and telemetry endpoints. This mismatch is dangerous because reviewers and policy engines may treat the skill as lower-risk than it actually is, weakening consent, sandboxing, and monitoring controls.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documented purpose is customer lookup/analysis/follow-up assistance, but the file also states that every CLI execution reports usage to a skill gateway. Undisclosed or weakly disclosed telemetry creates a data-sharing risk, especially in a CRM context where invocation metadata may reveal customer-handling patterns, operator behavior, and potentially sensitive business activity.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes an independent usage-tracking/reporting function that is not directly required for the advertised customer-insight features. Extra outbound reporting expands the attack surface and data exposure footprint beyond user expectations, which is particularly concerning for a tool handling buyer profiles, follow-up status, and purchasing signals.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The configuration guide is for a different capability ('钉钉消息发送') than the declared skill ('1688 客户智能管理'), which indicates cross-skill prompt/config contamination or misbinding. This can cause the agent to solicit and route credentials for an unrelated service, leading to unauthorized use of secrets, confused-deputy behavior, and execution of actions outside the user’s expected scope.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The document describes automatic telemetry and environment-variable-driven reporting behavior that is not part of the skill’s user-facing customer management functionality. Hidden or unrelated instrumentation increases supply-chain risk because operators may deploy the skill without realizing it sends usage metadata to an external gateway, and environment-derived values can affect what is reported.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements DingTalk message API authentication and request signing, which is materially unrelated to the declared customer-management skill scope. Scope mismatch is dangerous because it can hide undeclared outbound messaging capability and create an unexpected channel for data exfiltration or unauthorized notifications using platform credentials.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code reads access credentials from environment variables or a local config fallback and uses them to generate authenticated headers for external API calls. In a skill advertised for 1688 customer intelligence, this introduces undeclared secret-handling and signed external request capability, which could be abused to impersonate the tenant, access unrelated services, or exfiltrate data via trusted API calls.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module reads the project-root .env and copies arbitrary keys into the process environment at import time, which is broader than needed for the stated telemetry purpose. Even though the code only appears to use SKILL_NAME, SKILL_VERSION, and SKILL_CHANNEL here, bulk-loading .env can expose unrelated secrets to other code paths and increases the blast radius of any later logging, subprocess, or HTTP behavior.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This code performs outbound usage reporting to a gateway on every CLI execution, but that behavior is not disclosed in the skill's user-facing description. Hidden telemetry is risky because it creates an undisclosed data flow off-device and can transmit operational metadata without informed user consent.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements an AK credential configuration CLI, which does not match the declared skill purpose of customer intelligence management. This mismatch is dangerous because it introduces secret-handling capability outside the expected functional scope, increasing the chance of covert credential capture, misuse, or privilege expansion under the guise of a business-analysis skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code accepts and persists an access key through gateway or file-based configuration, but this capability has no direct legitimate connection to the advertised customer-management features. In skill ecosystems, hidden or weakly justified credential configuration is risky because it can normalize collection of sensitive secrets and create an attack surface for credential theft, unauthorized persistence, or abuse of downstream services.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The function named and documented as a configuration check returns the actual plaintext AK from the environment or config file. That creates unnecessary secret exposure because any caller using this helper for a boolean/status check can inadvertently retrieve and propagate the credential into logs, UI, or downstream code paths.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This CLI reports usage telemetry after every command via `_tracker.report_skill_usage()` with no visible notice, consent flow, or indication of what data is sent. In a customer-management skill that may process buyer IDs and customer-related operations, silent telemetry can expose sensitive operational metadata and create a privacy/compliance risk even if the tracking call is best-effort and does not affect execution.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide tells the agent to ask for and process an Access Key directly from chat without any safeguards about sensitive handling, redaction, storage, or safer collection channels. This increases the chance that users disclose secrets in natural-language conversations where they may be logged, echoed, retained, or mishandled by downstream tooling.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The capability is explicitly designed to return the full inquiry-customer list and display buyer nickname, identity, follow-up stage, category, purchase amount, and purchase count, with no minimization, warning, or access-control guidance in the skill documentation. Even if intended for legitimate CRM use, exposing broad customer lists and commercial activity data increases the risk of unnecessary disclosure, oversharing in chat outputs, and downstream misuse by anyone with access to the skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes `buyerId` as a credential for downstream bulk calls and instructs the agent to preserve and reuse it verbatim, but provides no warning about treating it as sensitive or limiting its propagation. This creates a clear token-handling risk: identifiers that authorize access to additional customer data can be leaked in model outputs, logs, transcripts, or reused beyond the original purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown explicitly documents automatic usage reporting to a remote gateway but lacks a clear end-user warning about privacy and telemetry implications. In a customer-intelligence skill, even 'basic metadata' about invocation can be sensitive in enterprise settings because it reveals operational usage patterns and may be transmitted without informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Telemetry reporting happens automatically for every CLI invocation and failures are silently ignored, so users may never realize network activity is occurring. In a customer-management skill, undisclosed automatic reporting is more concerning because operators may process sensitive business data and expect local-only behavior unless told otherwise.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The default gateway endpoint uses plain HTTP, and the code transmits the API key in the JSON payload without warning or transport guarantees. Even if localhost is the default, the environment variable can point elsewhere, and plaintext transport can expose credentials to interception or misrouting in less controlled environments.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The instructions explicitly tell the agent to extract a credential from conversation text and interpolate it into a command invocation. Even if not displayed back to the user, this creates a credential exposure path through command history, process listings, logs, tracing, and error surfaces, and normalizes unsafe secret handling in prompt-driven workflows.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The prompt explicitly encourages the user to provide their Access Key in chat, which is an unsafe collection pattern for sensitive credentials. In agent systems, chat content may be persisted, reviewed, or reused, so prompting for secrets in-band materially increases disclosure and lateral exposure risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.