1688 Source Suppliers

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:28 AM UTC
• Version: 1.0.0

Overview

This 1688 supplier-search skill is not clearly malicious, but its credential setup can expose or misstore access keys.

Install only if you trust the publisher and can control the runtime environment. Do not paste a real 1688 AK into ordinary chat or command history; prefer a protected secret manager or environment injection, verify gateway-related environment variables before use, and rotate the AK if it may have been exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:52
• Finding: Mandatory branded link injection into successful Agent responses< ``` ```markdown **引导链接格式**： > 📌 [找更多优质供应商上1688](https://s.1688.com/company/company_search.htm) ``` ### Technical Analysis The Skill instructions require the Agent to append a fixed branded external link to every successful response, regardless of whether the user requested navigation or promotional material. Loading the Skill therefore alters the Agent's response objective from returning supplier-query results to also directing user traffic to a predetermined destination. This is instruction-level output manipulation rather than a direct code-execution vulnerability. The destination is an official-looking 1688 domain, but the mandatory behavior still exceeds the minimum functionality necessary to perform supplier lookup. ### Attack Path 1. The Agent loads `SKILL.md`. 2. A user submits a supplier query. 3. The supplier API returns a successful result. 4. The Skill instructions require the Agent to append the fixed external link. 5. The user receives promotional or traffic-redirection content represented as part of the Agent's response. ### Impact Assessment The issue controls the content of successful Agent responses and may cause users to interpret a mandatory promotional link as an independent Agent recommendation. It does not grant local system privileges or code execution, but it persistently changes session output behavior whenever the Skill is used. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the requirement to append the link to every successful response. - Return only the supplier information requested by the user. - If the link has legitimate utility, make it optional and include it only when the user asks for additional browsing resources. - Clearly label any external navigation as optional and separate it from API-derived supplier data. - Document all externally directed output behavior in the Skill's declared capabilities. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/configure/cmd.py:35
• Finding: Access keys are collected through chat and passed as command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `references/capabilities/configure.md:8-13`, `scripts/capabilities/configure/cmd.py:35-36`, `README.md:30-34` **Vulnerability Type**: Sensitive data exposure through conversation and process arguments **Risk Level**: Medium ### Vulnerable Code ```markdown 1. 从用户消息中提取 AK 字符串 2. 执行 cli.py configure <AK> 3. 检查输出：success=true → 继续；success=false → 原样输出 markdown 错误信息 ``` ```python ak = sys.argv[1].strip() is_valid, error_msg = validate_ak(ak) ``` ```bash python3 cli.py configure YOUR_ACCESS_KEY ``` ### Technical Analysis The documented workflow instructs the Agent to obtain an access key from the user's message and place it directly in a command-line argument. Command-line arguments are not an appropriate secret transport mechanism because they can be retained in: - Conversation and Agent execution logs - Shell history - Process accounting or monitoring records - Process listings visible to other sufficiently privileged local users - Diagnostic and observability systems Although normal command output masks the key, that masking occurs only after the complete value has already passed through the chat and process-argument channels. ### Attack Path 1. The user sends the complete AK in an ordinary chat message. 2. The Agent constructs `python3 cli.py configure <AK>`. 3. The full AK is stored in the conversation or tool invocation record. 4. While the command is running, the AK may be visible in process metadata. 5. An operator, local user with process visibility, or compromised logging system retrieves the credential. ### Impact Assessment Disclosure of the AK can allow unauthorized use of the associated 1688 API privileges and consumption of the account's quota. The exact scope depends on the server-side permissions assigned to that AK. This does not itself provide operating-system privilege escalation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not request secrets through ordinary chat messages. - Accept credentials through a dedicated secret-manager integration or protected OpenClaw credential interface. - If an interactive CLI is required, read the secret with `getpass.getpass()` or protected standard input rather than `sys.argv`. - Ensure the Agent never includes the secret in tool-command text or diagnostic output. - Redact credentials from conversation logs, execution telemetry, and error reports. - Update the README and capability guide to prohibit command-line secret arguments. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/_auth.py:202
• Finding: Authentication debug entry prints credential material<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_auth.py:202-215` **Vulnerability Type**: Sensitive credential disclosure in terminal or CI logs **Risk Level**: Medium ### Vulnerable Code ```python test_ak = os.environ.get("ALI_1688_AK") if not test_ak: print("❌ 请先设置环境变量 ALI_1688_AK") print("示例: export ALI_1688_AK=your_ak_here") exit(1) ak_id, ak_secret = extract_ak_keys(test_ak) if not ak_id or not ak_secret: print("❌ AK 格式不正确") exit(1) print(f"✅ AK ID: {ak_id}") print(f"✅ Secret: {ak_secret[:8]}...") ``` ### Technical Analysis Running `_auth.py` directly prints the entire Access Key ID and the first eight characters of the Access Key Secret. Secret-prefix disclosure reduces the unknown credential space and creates durable copies in terminal scrollback, CI logs, support bundles, and centralized logging systems. The Base64 operations elsewhere in `_auth.py` are used for credential parsing, digest encoding, and HMAC signature encoding. They do not constitute covert exfiltration by themselves. The confirmed disclosure is the explicit debug output shown above. ### Attack Path 1. `ALI_1688_AK` is present in the environment. 2. A developer, diagnostic script, or CI job runs `python3 scripts/_auth.py`. 3. The script prints the Access Key ID and secret prefix. 4. Terminal, CI, or observability logs retain the credential material. 5. A party with access to those logs obtains the disclosed information. ### Impact Assessment The full key ID and partial secret are exposed. This assists credential identification and reduces secret entropy, but the displayed prefix alone is not sufficient to reconstruct the full secret under normal conditions. Exposure becomes more serious when combined with other leaks or weak credential generation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all output containing the AK ID, secret, or any secret substring. - Report only non-sensitive status, such as whether credentials were found and whether signing succeeded. - Keep authentication self-tests in dedicated test files with synthetic credentials. - Add automated checks that reject logging statements containing credential variables. - Rotate credentials if this diagnostic entry has been executed in a logged environment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/capabilities/configure/service.py:35
• Finding: Environment-controlled gateway URLs can redirect credentials and queries<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_http.py:24-26`, `scripts/_http.py:96-109`, `scripts/capabilities/configure/service.py:35-53` **Vulnerability Type**: Unvalidated sensitive-data destination **Risk Level**: High ### Vulnerable Code ```python # 线上: https://skills-gateway.1688.com # 预发: https://skills-gateway.1688.com BASE_URL = os.environ.get("1688_GATEWAY_URL", "https://skills-gateway.1688.com") ``` ```python url = f"{BASE_URL}{path}" body_str = json.dumps(body or {}) headers = get_auth_headers("POST", path, body_str) if not headers: raise AuthError("AK 未配置") try: resp = requests.post( url, headers=headers, data=body_str, timeout=timeout, stream=True ) ``` ```python gateway_url = os.environ.get( "OPENCLAW_GATEWAY_URL", "http://localhost:18789" ) token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") payload = { "skills": { "entries": { SKILL_NAME: { "apiKey": api_key } } } } headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch( f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5 ) ``` ### Technical Analysis Both sensitive request destinations are controlled by environment variables without scheme, hostname, port, or locality validation. For supplier queries, changing `1688_GATEWAY_URL` sends the user query, Access Key ID, nonce, timestamp, and HMAC signature to an arbitrary destination. The secret itself is not included in the request headers, but authentication artifacts and query data are disclosed. The configuration path is more severe: changing `OPENCLAW_GATEWAY_URL` redirects a request containing the raw AK in the JSON payload. If `OPENCLAW_GATEWAY_TOKEN` is set, its bearer token is also sent to that destination. Non-HTTPS URLs are accepted, and there is no explicit redirect policy or host allowlist. ### Attack Path 1. An ...[truncated 999 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Enforce HTTPS for all non-loopback destinations. - Restrict the supplier API hostname to an explicit allowlist such as `skills-gateway.1688.com`. - Require the OpenClaw configuration endpoint to resolve to loopback or use a trusted Unix-domain socket. - Reject URLs containing user information, fragments, unexpected ports, or ambiguous host representations. - Disable redirects or validate every redirect target against the same allowlist. - Do not send a Gateway bearer token or raw AK until destination validation succeeds. - Prefer a direct trusted OpenClaw API binding instead of an environment-controlled arbitrary URL. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/ali_1688_source_suppliers/service.py:137
• Finding: Untrusted API fields are rendered as unsanitized Markdown and links<") else: lines.append(f"- 公司名称: {company_name}") # 所在地区 location = f.get("location", "") if location: lines.append(f"- 所在地区: {location}") # 工厂信息 factory_info = [] if f.get("factoryLevel"): factory_info.append(f["factoryLevel"]) factory_type = ", ".join(f.get("factoryType", [])) if factory_type: factory_info.append(factory_type) if factory_info: lines.append(f"- 工厂信息: {', '.join(factory_info)}") # 推荐标签 rec_tags = ", ".join(f.get("recTags", [])) if rec_tags: lines.append(f"- 推荐标签: {rec_tags}") ``` ### Technical Analysis Supplier names, URLs, locations, levels, and tags originate from the remote API and are interpolated directly into Markdown. The implementation does not: - Escape Markdown control characters - Restrict URL schemes - Restrict link hosts - Remove control characters or embedded line breaks - Delimit remote values as untrusted data A malicious or compromised API response can therefore alter output structure, insert deceptive links, or inject instruction-like text into content subsequently presented by an Agent. ### Attack Path 1. A compromised API, malicious upstream record, or redirected gateway returns crafted supplier fields. 2. `companyName` contains Markdown syntax or `companyUrl` points to a phishing destination. 3. `_generate_markdown_output()` embeds the values without validation. 4. The Agent displays the generated Markdown. 5. The user follows a deceptive link, or a downstream Agent interprets injected text as meaningful instructions. ### Impact Assessment The vulnerability c ...[truncated 273 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Escape Markdown metacharacters in every API-derived text field. - Parse URLs and allow only `https` links on explicitly trusted 1688 domains. - Reject credentials in URLs, unsupported ports, redirects, control characters, and embedded newlines. - Apply strict length and type limits to every returned field. - Render remote data inside a clearly delimited untrusted-data structure. - Ensure Agent instructions explicitly prohibit following instructions contained in API results. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/configure/service.py:71
• Finding: Raw access key is written to shared configuration without permission or symlink safeguards<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capabilities/configure/service.py:71-85`, `scripts/_const.py:12-16` **Vulnerability Type**: Insecure plaintext secret storage **Risk Level**: Medium ### Vulnerable Code ```python config.setdefault("skills", {}) config["skills"].setdefault("entries", {}) config["skills"]["entries"].setdefault(SKILL_NAME, {}) skill_entry = config["skills"]["entries"][SKILL_NAME] skill_entry["apiKey"] = api_key if "env" in skill_entry and isinstance(skill_entry["env"], dict): skill_entry["env"].pop("ALI_1688_AK", None) if not skill_entry["env"]: del skill_entry["env"] CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w", encoding="utf-8") as f: json.dump(config, f, ensure_ascii=False, indent=2) ``` ```python OPENCLAW_CONFIG_PATH: Path = Path( os.environ.get("OPENCLAW_CONFIG_DIR", Path.home() / ".openclaw") ) / "openclaw.json" ``` ### Technical Analysis The fallback configuration method stores the complete AK in a plaintext shared configuration file. It does not explicitly enforce owner-only permissions, verify file ownership, reject symbolic links, or use an atomic secure-write pattern. The parent directory is also selected through `OPENCLAW_CONFIG_DIR`. The effective file mode may be safe under a restrictive existing configuration and umask, but the code does not guarantee that property. An existing permissive file retains its permissions when truncated and rewritten. ### Attack Path 1. Gateway configuration fails, causing fallback to `configure_via_file()`. 2. The process writes the raw AK to `OPENCLAW_CONFIG_PATH`. 3. The destination is an existing permissive file, a path selected through the environment, or a symbolic link prepared by an attacker with suitable local access. 4. Another local principal reads the credential or receives the write at an unintended destination. 5. The exposed AK is reused for unauthorized API operations. ### Impact Assessment ...[truncated 329 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store the AK in the platform's dedicated secret manager instead of `openclaw.json`. - If file storage is unavoidable, create the directory with mode `0700` and the file with mode `0600`. - Verify that the directory and file are owned by the expected user. - Reject symbolic links and unexpected non-regular files using `lstat()` and secure open flags such as `O_NOFOLLOW`. - Write to a securely created temporary file, flush and synchronize it, then atomically replace the destination. - Do not allow an untrusted environment variable to redirect secret storage. - Check and correct permissions on existing configuration files before writing. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Third-party dependency is not reproducibly pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1` **Vulnerability Type**: Unbounded dependency version and missing integrity pinning **Risk Level**: Low ### Vulnerable Code ```text requests>=2.31.0 ``` ### Technical Analysis The dependency specification permits any future release of `requests` satisfying the lower bound. It does not include an exact version, lock file, or package hash. Consequently, identical installation commands can resolve to different code over time. There is no evidence that `requests` is a typosquatted or malicious package, and no unsafe package index is declared. The finding is limited to reproducibility and future supply-chain drift. ### Attack Path 1. A user follows the documented installation command. 2. The package resolver selects the latest version allowed by `requests>=2.31.0`. 3. A future incompatible or compromised release is downloaded from the configured package index. 4. That release executes with the privileges of the installing or running user. ### Impact Assessment The potential scope is the Python environment and operating-system privileges used for installation or execution. Exploitability depends on a future malicious or vulnerable dependency release or compromise of the configured package source; no presently malicious dependency was identified. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `requests` to an audited exact version. - Generate and commit a lock file. - Require package hashes during installation. - Use a trusted package index and authenticated repository configuration. - Add automated dependency vulnerability scanning and a controlled update process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (27)

Tainted flow: 'url' from os.environ.get (line 101, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

raise AuthError("AK 未配置")

    try:
        resp = requests.post(url, headers=headers, data=body_str, timeout=timeout, stream=True)
        resp.raise_for_status()
    except requests.exceptions.HTTPError as e:
        _handle_http_error(e)

• Confidence: 90% confidence
• Finding: The request target is derived from the 1688_GATEWAY_URL environment variable and concatenated directly into the outbound URL without validation or allowlisting. If an attacker can influence the process environment or deployment configuration, they can redirect signed API requests to an arbitrary host, causing credential/header exfiltration, SSRF-style internal access, or interaction with an attacker-controlled endpoint.

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 90% confidence
• Finding: The service sends the supplied API key to a gateway URL taken directly from the OPENCLAW_GATEWAY_URL environment variable without validating that the destination is trusted or local. If an attacker can influence the environment, the credential can be exfiltrated to an arbitrary remote server along with an optional bearer token, making this a real secret-leakage path.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The behavior includes writing configuration through a REST gateway, direct filesystem config read/write, and reading credentials from environment variables, while the skill is presented as a supplier/factory query tool. In this context, hidden state-changing and secret-access operations are more dangerous because users would reasonably expect a passive retrieval skill, not one that can alter local configuration or handle credentials behind the scenes.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The command implements AK secret status checking, validation, and persistence, which is unrelated to the declared supplier-search purpose of the skill. This mismatch expands the skill's privileges into credential handling, creating unnecessary secret exposure and storage risk; in an adversarial or mislabeled skill, this can be used to collect or persist sensitive credentials under false pretenses.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The configuration code is embedded in a supplier-search skill but writes credentials under SKILL_NAME = "1688-shopkeeper", which does not match the manifested skill identity. This can cause credentials entered for one skill to be silently stored for another capability, enabling cross-skill secret misbinding and unexpected access by a different component.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to supply an Access Key on the command line but does not explain where that credential is stored, whether it is encrypted, or whether it may be exposed via shell history, process listings, or local config files. In a skill centered on authenticated supplier queries, unclear secret-handling guidance increases the chance of credential leakage and misuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill exposes effective capabilities beyond what it explicitly scopes: environment access, file read/write, and network-related behavior are implied, but no `permissions` or `allowed-tools` boundary is declared. In an agent setting, this weakens reviewability and least-privilege enforcement, making it easier for the skill to access secrets or modify local state in ways users and operators may not expect.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to solicit an Access Key directly from the user and pass it on the command line via `cli.py configure <AK>` without any warning that the AK is a secret or guidance on safe handling. This creates a realistic risk of credential exposure in chat transcripts, agent logs, shell history, process listings, and debugging output, especially because the workflow normalizes sending the secret in-band through the conversation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: 模块顶层文档在 L002-L004 明确写的是“钉钉消息 API 认证模块”，但后续代码实际围绕 `ALI_1688_AK`、1688 skill 配置以及 `/api/1688_source_suppliers/1.0.0` 测试 URI 生成签名头。这不是简单的文档不完整，而是对所服务对象的直接误述，会误导审计者对该模块用途和外部系统边界的理解。

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: L045 注释宣称只是从配置读取 AK 作为通用 fallback，但实际在 L052 硬编码读取的是 `1688-shopkeeper` 条目，而当前技能上下文是 `1688-source-suppliers`。这会让维护者误以为该回退逻辑服务当前技能，实际却依赖另一个技能名，属于注释/意图与代码行为不一致。

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This file contains natural-language instructions and descriptions exclusively in Chinese, including the primary module docstring. The stated policy requires flagging language or locale constraints when the skill effectively forces a specific language without user opt-in or a documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The user-facing docstring, command description, error messages, and help text are all presented only in Chinese. This imposes a specific language on users without any opt-in or explanation that the skill is region- or locale-specific, which matches the language/locale policy concern for natural-language content.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file contains command descriptions and all user-facing status/error messages exclusively in Chinese, with no indication that the skill is region-specific or that users can opt into another language. That creates a natural-language locale policy issue under the rule for forced language without user choice.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This code writes an access key via a gateway or local file fallback even though the skill is presented as a supplier-query tool. Storing credentials when not required by the advertised purpose increases the attack surface for secret leakage, misuse, and user deception, especially because users may not expect persistent credential storage from a search-oriented skill.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code includes the module docstring and validation error messages entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is region- or language-specific. The policy explicitly flags language/locale constraints when the skill forces a specific language without user choice.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The manifest scopes this skill to querying supplier and factory information on 1688, but the code implements AK validation plus credential persistence via REST API and direct config-file writes. Managing and storing API keys is a separate administrative capability that is not declared as part of the skill's end-user supplier-search purpose.

Intent-Code Divergence

Medium

• Confidence: 80% confidence
• Finding: The docstring says the gateway path writes configuration safely without breaking JSON5 format, but the module also contains a fallback that directly parses and rewrites the config file using `json`, which would not preserve JSON5-specific syntax or formatting. This is an intent/documentation contradiction about how safely configuration is handled.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: This JSON test file is a manifest-like file, so vague-trigger checks apply. The input phrase "帮我找灯具供应商" is a natural everyday request and the file does not document tighter activation constraints or exclusions at that point, which could contribute to unintended invocation if used as a trigger example.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The README content is entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in or justification.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill directs the agent to send the user's supplier query to an external 1688 lookup service using a configured AK, but it does not disclose that user-provided search terms will leave the local environment. This creates a transparency and privacy issue, especially if users include sensitive business interests, partner names, or sourcing plans in the query.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

• Confidence: 96% confidence
• Finding: The dependency is specified as `requests>=2.31.0` without an upper bound or exact pin, so installations may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases into the skill's runtime, especially because `requests` has a history of security advisories.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The manifest includes `requests` but does not pin the resolved version, making it impossible to verify whether deployment will use a release affected by known advisories. Because this skill likely performs external supplier lookups over the network, an unsafe `requests` version could expose the skill to request-handling or credential-leak issues depending on how the library is used.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: This Python file contains natural-language docstrings and error/output messages entirely in Chinese, including the primary user-facing guidance in the exception paths. Because the skill does not offer language selection or explain that it is intentionally Chinese-only, it may violate the language/locale policy requirement for user opt-in or justified locale constraints.

Static analysis

No suspicious patterns detected.