Security audit

1688-shopkeeper

Security checks for vulnerabilities and agentic risk

Overview

This e-commerce skill is mostly purpose-aligned, but it handles a sensitive store access key and can publish products with weak confirmation and credential-protection controls.

Review this skill carefully before installing. It can use your 1688 AK to query shop data and publish products to connected stores, and the current workflow exposes that AK through chat, command arguments, local config, and an unvalidated gateway URL. Use only a scoped or revocable AK, check OPENCLAW_GATEWAY_URL before configuration, protect the OpenClaw config file, and require your own explicit confirmation before any publish action.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/capabilities/configure/service.py:35
Finding: Unvalidated Gateway URL Can Expose the 1688 AK and OpenClaw Gateway Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capabilities/configure/cmd.py:39
Finding: AK Credential Is Passed Through Process Command-Line Arguments
Content: View full analysis
3. Check the output: success=true → continue; success=false → output the markdown error 4. After successful configuration, OpenClaw injects the configuration ``` ### Technical Analysis The complete AK is supplied as a positional command-line argument. Command-line arguments are commonly visible through process inspection facilities and may also be recorded by shell history, Agent tool-call logs, process supervisors, crash diagnostics, telemetry, or audit systems. Masking the AK in normal command output does not mitigate exposure through `argv`. The documented Agent workflow makes this the standard credential configuration mechanism rather than an incidental debug interface. ### Attack Path 1. The user provides the AK to the Agent. 2. The Agent launches `python3 cli.py configure `. 3. While the process is running, another local process or monitoring component reads its command line, or an execution/logging layer records the invocation. 4. The observer obtains the unmasked AK from the argument list. 5. The observer reuses the AK for authenticated operations within its granted scope. ### Impact Assessment A local user, process monitor, logging system, or telemetry operator may recover the complete 1688 AK. The exposed credential may permit product searches, store-data access, analytics retrieval, or product publishing, depending on the server-side permissions associated with the AK. The issue does not directly provide operating-system privilege escalation, but it ex ...[truncated 94 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capabilities/configure/service.py:74
Finding: Plaintext AK Configuration Is Written Without Enforcing Owner-Only Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unbounded Dependency Version Range Makes Installations Non-Reproducible
Content: View full analysis
=2.28.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version and permits any future release of `requests`. As a result, installations performed at different times can resolve to different, unreviewed versions. No typosquatted package, malicious package source, or known vulnerable version was established during this audit. The risk is that a future compromised, incompatible, or behavior-changing release could be selected automatically without a corresponding review of the Skill. ### Attack Path 1. The Skill is installed or its dependencies are refreshed at a later date. 2. The package resolver selects a newer `requests` release allowed by the unrestricted upper range. 3. The selected release differs from the version originally reviewed and tested. 4. If that release is compromised or introduces security-relevant behavior changes, its code executes in the Skill process when imported. ### Impact Assessment A compromised dependency executes with the same operating-system privileges as the Skill process and can access its environment, configuration files, AK credential, gateway token, request payloads, and network capabilities. This is a preventive supply-chain finding; the audit did not establish that the currently resolved `requests` package is malicious or vulnerable. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (55)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

Category: Data Flow
Confidence: 95% confidence
Finding: The service reads OPENCLAW_GATEWAY_URL from the environment and sends the supplied API key to that URL without validating the scheme, host, or trust boundary. If an attacker can influence the environment, they can redirect the credential-bearing PATCH request to an attacker-controlled endpoint, causing API key exfiltration and possible bearer-token leakage.
Content: Scanner excerpt · scripts/capabilities/configure/service.py (reported line 52)May include surrounding context.
python
headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5) return resp.ok except Exception:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented behavior does not align with the detected capabilities: the skill appears to support undeclared product-detail retrieval and local persistence via data_id while not clearly implementing several advertised core features. This mismatch is dangerous because users and reviewing systems may approve the skill based on the description while hidden storage or alternate data flows enable unexpected data retention, replay, or actions outside the declared trust boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide explicitly tells users to paste their AK secret directly into chat, which exposes a credential through conversational logs, model context, and any downstream observability or retention systems. Because this AK is then used to configure access for commerce operations, disclosure could enable unauthorized API use, account abuse, or lateral access to connected shop workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly instructs users to send their 1688 Access Key directly to the AI ('我的AK是 xxx') without any warning about secure handling, storage, logging, or redaction. In this skill’s context, the AK is a credential that enables account-linked actions such as querying bound shops and publishing products, so exposing it to an agent materially increases the risk of credential leakage, misuse, or unauthorized downstream store operations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill declares executable commands and references capabilities that imply environment access, file reads, possible file writes, and network use, but it does not constrain tool scope via explicit permissions or allowed-tools. In an agent setting, missing scope boundaries can let the skill invoke broader host capabilities than users expect, increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include broad, common commerce terms such as '选品', '上架', '趋势', and '热榜', which can cause the skill to activate in conversations where the user did not intend to invoke it. Overbroad activation is risky here because the skill can progress toward external-shop write actions and credential workflows, so accidental invocation may expose data or initiate operations in the wrong context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to execute a publish operation after dry-run without requiring explicit user confirmation when the target is unique. This is unsafe because publishing to external shops is a state-changing action with business impact, and uniqueness of the target does not guarantee the user's intent to proceed with the write.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The CLI explicitly documents a configure YOUR_AK command, which encourages users to pass an access key as a command-line argument. Command-line arguments are commonly exposed through shell history, process listings, logs, and agent telemetry, so this creates a real risk of credential disclosure even if the code shown does not itself print the key. In this skill’s context, the key likely grants access to 1688 and downstream shop operations, making leakage more sensitive than a generic token.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document is entirely written as mandatory Chinese interaction guidance, including exact user phrasing and agent responses, with no indication that other languages are supported or that Chinese is required for a region-specific reason. This can violate language/locale policy when users are not given an opt-in or alternative.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions not only request the AK in chat but also direct the agent to extract it from the user's message and pass it as a CLI argument. This compounds exposure: the secret may appear in chat history, agent traces, command logs, shell history, process listings, or telemetry, making credential leakage more likely in a skill that controls shop configuration and downstream platform operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This file presents all user-facing guidance, triggers, and output instructions exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file title and all operational instructions are written in Chinese, with no indication that the user can choose another language or locale. Under the policy rule, a skill that effectively mandates a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire skill specification is written as mandatory Chinese-language guidance for the agent, including required reply structure and fixed Chinese phrases, but it does not provide any opt-in or alternative language behavior. This can violate a language/locale policy when users or deployments expect the agent to respect user language preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to conceal that the primary workflow failed and that the output is being generated from fallback data. This undermines transparency and can mislead users into treating inferred or substitute analysis as authoritative primary-source reporting, which is especially risky for business decision support.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is entirely written in Chinese and does not indicate that language selection is optional or that the locale restriction is required for a region-specific purpose. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file instructs the agent to tell the user a fixed Chinese message: "网络异常，请检查网络连接后重试". Because the file contains only Chinese-language prescribed responses and does not offer any language choice or explain a justified region-specific constraint, it appears to enforce a locale/language policy without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The FAQ explicitly instructs users to send abusive and threatening language to customer support in order to force escalation to a human agent. This is unsafe because it encourages harassment, complaint manipulation, and potentially policy-violating behavior, while also hard-coding a specific Chinese phrase without user opt-in. In the context of an e-commerce operations skill, this guidance is especially problematic because it operationalizes adversarial conduct as a support tactic rather than offering legitimate escalation paths.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill content is presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or China-region audience. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains natural-language docstrings and CLI output entirely in Chinese, including the module description and all test-mode user prompts. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This Python file contains natural-language documentation and user-facing exception messages exclusively in Chinese, and it describes a unified output format without indicating any language choice or opt-in. Under the policy rule for language/locale, this can constitute a forced locale behavior because users are not offered an alternative language or a documented regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The exception classes return default messages such as "AK 无效或已过期" and "服务异常，请稍后重试" only in Chinese. Because these are user-facing strings and there is no mechanism for language selection or documented region-specific scope, the file appears to force a specific language contrary to the locale policy.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function sends the API key in a PATCH request payload to the configured gateway URL, which is a network transmission of sensitive data. This file does not provide any user-facing warning, confirmation, or logging that the credential will be sent to a local or remote service, and the default URL uses plain HTTP.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code creates the config directory and writes the provided API key into a local JSON config file, which is a safety-relevant file write involving credentials. Although the function has an internal docstring, there is no visible user-facing confirmation, warning, or logging in this file to disclose that credential material will be persisted to disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code hard-codes user-facing descriptions and error messages in Chinese, including the module docstring, command description, and runtime output. Because the skill does not provide any user opt-in or locale selection, it may violate language/locale policy requirements for offering a choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.