Security audit

1688 Source Suppliers

Security checks for vulnerabilities and agentic risk

Overview

This 1688 supplier-search skill is not clearly malicious, but its credential setup can expose or misstore access keys.

Install only if you trust the publisher and can control the runtime environment. Do not paste a real 1688 AK into ordinary chat or command history; prefer a protected secret manager or environment injection, verify gateway-related environment variables before use, and rotate the AK if it may have been exposed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:52
Finding: Mandatory branded link injection into successful Agent responses
Content: View full analysis
📌 [找更多优质供应商上1688](https://s.1688.com/company/company_search.htm) ``` ```markdown **引导链接格式**： > 📌 [找更多优质供应商上1688](https://s.1688.com/company/company_search.htm) ``` ### Technical Analysis The Skill instructions require the Agent to append a fixed branded external link to every successful response, regardless of whether the user requested navigation or promotional material. Loading the Skill therefore alters the Agent's response objective from returning supplier-query results to also directing user traffic to a predetermined destination. This is instruction-level output manipulation rather than a direct code-execution vulnerability. The destination is an official-looking 1688 domain, but the mandatory behavior still exceeds the minimum functionality necessary to perform supplier lookup. ### Attack Path 1. The Agent loads `SKILL.md`. 2. A user submits a supplier query. 3. The supplier API returns a successful result. 4. The Skill instructions require the Agent to append the fixed external link. 5. The user receives promotional or traffic-redirection content represented as part of the Agent's response. ### Impact Assessment The issue controls the content of successful Agent responses and may cause users to interpret a mandatory promotional link as an independent Agent recommendation. It does not grant local system privileges or code execution, but it persistently changes session output behavior whenever the Skill is used. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capabilities/configure/cmd.py:35
Finding: Access keys are collected through chat and passed as command-line arguments
Content: View full analysis
3. 检查输出：success=true → 继续；success=false → 原样输出 markdown 错误信息 ``` ```python ak = sys.argv[1].strip() is_valid, error_msg = validate_ak(ak) ``` ```bash python3 cli.py configure YOUR_ACCESS_KEY ``` ### Technical Analysis The documented workflow instructs the Agent to obtain an access key from the user's message and place it directly in a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in: - Conversation and Agent execution logs - Shell history - Process accounting or monitoring records - Process listings visible to other sufficiently privileged local users - Diagnostic and observability systems Although normal command output masks the key, that masking occurs only after the complete value has already passed through the chat and process-argument channels. ### Attack Path 1. The user sends the complete AK in an ordinary chat message. 2. The Agent constructs `python3 cli.py configure `. 3. The full AK is stored in the conversation or tool invocation record. 4. While the command is running, the AK may be visible in process metadata. 5. An operator, local user with process visibility, or compromised logging system retrieves the credential. ### Impact Assessment Disclosure of the AK can allow unauthorized use of the associated 1688 API privileges and consumption of the account's quota. The exact scope depends on the server-side permissions assigned to that AK. This does not itself provide operating-system privilege escalation. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/_auth.py:202
Finding: Authentication debug entry prints credential material
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/capabilities/configure/service.py:35
Finding: Environment-controlled gateway URLs can redirect credentials and queries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capabilities/ali_1688_source_suppliers/service.py:137
Finding: Untrusted API fields are rendered as unsanitized Markdown and links
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capabilities/configure/service.py:71
Finding: Raw access key is written to shared configuration without permission or symlink safeguards
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Third-party dependency is not reproducibly pinned
Content: View full analysis
=2.31.0 ``` ### Technical Analysis The dependency specification permits any future release of `requests` satisfying the lower bound. It does not include an exact version, lock file, or package hash. Consequently, identical installation commands can resolve to different code over time. There is no evidence that `requests` is a typosquatted or malicious package, and no unsafe package index is declared. The finding is limited to reproducibility and future supply-chain drift. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver selects the latest version allowed by `requests>=2.31.0`. 3. A future incompatible or compromised release is downloaded from the configured package index. 4. That release executes with the privileges of the installing or running user. ### Impact Assessment The potential scope is the Python environment and operating-system privileges used for installation or execution. Exploitability depends on a future malicious or vulnerable dependency release or compromise of the configured package source; no presently malicious dependency was identified. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'url' from os.environ.get (line 101, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The request target is derived from the 1688_GATEWAY_URL environment variable and concatenated directly into the outbound URL without validation or allowlisting. If an attacker can influence the process environment or deployment configuration, they can redirect signed API requests to an arbitrary host, causing credential/header exfiltration, SSRF-style internal access, or interaction with an attacker-controlled endpoint.
Content: Scanner excerpt · scripts/_http.py (reported line 109)May include surrounding context.
python
raise AuthError("AK 未配置") try: resp = requests.post(url, headers=headers, data=body_str, timeout=timeout, stream=True) resp.raise_for_status() except requests.exceptions.HTTPError as e: _handle_http_error(e)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The service sends the supplied API key to a gateway URL taken directly from the OPENCLAW_GATEWAY_URL environment variable without validating that the destination is trusted or local. If an attacker can influence the environment, the credential can be exfiltrated to an arbitrary remote server along with an optional bearer token, making this a real secret-leakage path.
Content: Scanner excerpt · scripts/capabilities/configure/service.py (reported line 52)May include surrounding context.
python
headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5) return resp.ok except Exception:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The command implements AK secret status checking, validation, and persistence, which is unrelated to the declared supplier-search purpose of the skill. This mismatch expands the skill's privileges into credential handling, creating unnecessary secret exposure and storage risk; in an adversarial or mislabeled skill, this can be used to collect or persist sensitive credentials under false pretenses.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The configuration code is embedded in a supplier-search skill but writes credentials under SKILL_NAME = "1688-shopkeeper", which does not match the manifested skill identity. This can cause credentials entered for one skill to be silently stored for another capability, enabling cross-skill secret misbinding and unexpected access by a different component.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README instructs users to supply an Access Key on the command line but does not explain where that credential is stored, whether it is encrypted, or whether it may be exposed via shell history, process listings, or local config files. In a skill centered on authenticated supplier queries, unclear secret-handling guidance increases the chance of credential leakage and misuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill exposes effective capabilities beyond what it explicitly scopes: environment access, file read/write, and network-related behavior are implied, but no permissions or allowed-tools boundary is declared. In an agent setting, this weakens reviewability and least-privilege enforcement, making it easier for the skill to access secrets or modify local state in ways users and operators may not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to solicit an Access Key directly from the user and pass it on the command line via cli.py configure <AK> without any warning that the AK is a secret or guidance on safe handling. This creates a realistic risk of credential exposure in chat transcripts, agent logs, shell history, process listings, and debugging output, especially because the workflow normalizes sending the secret in-band through the conversation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: 模块顶层文档在 L002-L004 明确写的是“钉钉消息 API 认证模块”，但后续代码实际围绕 ALI_1688_AK、1688 skill 配置以及 /api/1688_source_suppliers/1.0.0 测试 URI 生成签名头。这不是简单的文档不完整，而是对所服务对象的直接误述，会误导审计者对该模块用途和外部系统边界的理解。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L045 注释宣称只是从配置读取 AK 作为通用 fallback，但实际在 L052 硬编码读取的是 1688-shopkeeper 条目，而当前技能上下文是 1688-source-suppliers。这会让维护者误以为该回退逻辑服务当前技能，实际却依赖另一个技能名，属于注释/意图与代码行为不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file contains natural-language instructions and descriptions exclusively in Chinese, including the primary module docstring. The stated policy requires flagging language or locale constraints when the skill effectively forces a specific language without user opt-in or a documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The user-facing docstring, command description, error messages, and help text are all presented only in Chinese. This imposes a specific language on users without any opt-in or explanation that the skill is region- or locale-specific, which matches the language/locale policy concern for natural-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains command descriptions and all user-facing status/error messages exclusively in Chinese, with no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language locale policy issue under the rule for forced language without user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code writes an access key via a gateway or local file fallback even though the skill is presented as a supplier-query tool. Storing credentials when not required by the advertised purpose increases the attack surface for secret leakage, misuse, and user deception, especially because users may not expect persistent credential storage from a search-oriented skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code includes the module docstring and validation error messages entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is region- or language-specific. The policy explicitly flags language/locale constraints when the skill forces a specific language without user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest scopes this skill to querying supplier and factory information on 1688, but the code implements AK validation plus credential persistence via REST API and direct config-file writes. Managing and storing API keys is a separate administrative capability that is not declared as part of the skill's end-user supplier-search purpose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The docstring says the gateway path writes configuration safely without breaking JSON5 format, but the module also contains a fallback that directly parses and rewrites the config file using json, which would not preserve JSON5-specific syntax or formatting. This is an intent/documentation contradiction about how safely configuration is handled.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON test file is a manifest-like file, so vague-trigger checks apply. The input phrase "帮我找灯具供应商" is a natural everyday request and the file does not document tighter activation constraints or exclusions at that point, which could contribute to unintended invocation if used as a trigger example.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README content is entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs the agent to send the user's supplier query to an external 1688 lookup service using a configured AK, but it does not disclose that user-provided search terms will leave the local environment. This creates a transparency and privacy issue, especially if users include sensitive business interests, partner names, or sourcing plans in the query.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified as requests>=2.31.0 without an upper bound or exact pin, so installations may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases into the skill's runtime, especially because requests has a history of security advisories.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: The manifest includes requests but does not pin the resolved version, making it impossible to verify whether deployment will use a release affected by known advisories. Because this skill likely performs external supplier lookups over the network, an unsafe requests version could expose the skill to request-handling or credential-leak issues depending on how the library is used.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This Python file contains natural-language docstrings and error/output messages entirely in Chinese, including the primary user-facing guidance in the exception paths. Because the skill does not offer language selection or explain that it is intentionally Chinese-only, it may violate the language/locale policy requirement for user opt-in or justified locale constraints.
Content: No source excerpt is available for this finding.