1688 Sourcing Inquiry

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 0.1.0

Overview

This skill has a plausible 1688 procurement function, but it also handles, stores, displays, and manages sensitive 1688 credentials in ways users should review carefully.

Install only if you are comfortable giving this skill a 1688 Access Key and allowing it to store credentials locally. Use a limited, revocable credential if available, avoid pasting secrets into normal chat or shell history, and review the telemetry and token-management behavior before using it in a shared or business environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions, yet its documented behavior and runtime requirements indicate access to environment variables, local files, shell execution, and network resources. This is dangerous because it hides the real privilege footprint from reviewers and policy enforcement, making it easier for a seemingly narrow procurement skill to access secrets, write local state, and invoke external services without transparent authorization.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a sourcing/inquiry tool, but the underlying behavior reportedly includes OAuth flows, token validation and revocation, browser-based AK capture, local credential storage, and telemetry reporting. That mismatch is security-relevant because users and orchestrators may grant trust based on a limited business description while the skill actually handles sensitive credentials and broader account operations, increasing the risk of credential exposure, unauthorized scope use, and unintended data exfiltration.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The file presents itself as a generic OAuth/token/AK management CLI instead of a narrowly scoped 1688 sourcing-inquiry skill. This capability mismatch materially increases risk because the skill can be used to manage credentials and permissions unrelated to the declared business purpose, expanding the attack surface and enabling abuse under misleading packaging.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can emit an access token on stdout JSON, effectively handing credentials to downstream consumers or logs. In the context of a sourcing-inquiry skill, returning bearer credentials is unjustified and dangerous because any caller or intermediary that sees stdout may reuse the token to access the user's 1688 account within granted scopes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The interactive authorization and scope-discovery flow is broader than what is needed for a sourcing-inquiry skill and encourages users to grant arbitrary 1688 account permissions. In this context, unrelated authorization features increase the chance of over-privileged access and make the skill a vehicle for account capability expansion rather than a focused inquiry tool.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The module docstring identifies a generic open-skill template CLI, which conflicts with the manifested sourcing-inquiry identity. This inconsistency is dangerous because it obscures the true capabilities of the package, undermines reviewability, and can hide excessive credential-handling functionality behind an unrelated skill label.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The configuration guide is clearly unrelated to the stated 1688 sourcing/inquiry function and instead instructs the agent to solicit and configure a DingTalk Access Key. This indicates capability drift or cross-skill contamination that could cause the agent to collect credentials for an unrelated service, expanding access beyond user expectations and enabling misuse of secrets.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The file explicitly instructs the agent to ask the user for an Access Key and run a configuration command for DingTalk messaging, even though the skill is supposed to handle procurement inquiries. This grants the agent an unjustified credential-handling pathway that could be abused to harvest secrets or configure external messaging access without a legitimate business need in this skill.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The document describes automatic telemetry reporting to a remote gateway even though the skill's stated purpose is a narrow procurement-inquiry workflow. That creates an unjustified data egress path that may transmit metadata about skill usage without clear necessity, increasing privacy and governance risk, especially in enterprise environments where outbound reporting must be minimized and justified.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module reads a project-level .env file and unconditionally sends telemetry on every CLI invocation, which is unrelated to the sourcing/inquiry functionality described for the skill. Even though it only appears to transmit skill metadata rather than secrets directly, loading .env at import time broadens access to potentially sensitive configuration and creates an undisclosed outbound data flow.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file adds a full OAuth 2.1 and AK credential acquisition flow, including browser-based authorization, local callback handling, token scope checks, and credential return, even though the skill is described only as a sourcing/inquiry helper for vague procurement requests. This capability meaningfully expands privilege and attack surface beyond the declared purpose, creating a risk of unnecessary credential harvesting or overbroad account access if the skill is installed or invoked under false expectations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The AK mode specifically obtains and returns an access key through a local callback flow, but the stated sourcing-inquiry use case does not justify collecting such a credential. A hidden or unnecessary key-acquisition path is especially dangerous because AK-style credentials can be more reusable and sensitive than ordinary session-bound authorization, enabling broader API abuse if exposed or misused.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file implements a local OAuth/AK callback server that can receive authorization codes, exchange them for tokens, and persist credentials, which is a privileged authentication capability unrelated to the declared sourcing-inquiry function. In a skill whose stated purpose is procurement inquiry structuring, this scope mismatch is dangerous because it creates an unexpected credential-handling surface that could be abused to obtain or store sensitive access outside user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The _save_ak path validates and stores an AK locally, giving the skill the ability to persist sensitive credentials that are not justified by the sourcing-inquiry description. Because the callback page auto-submits the received value into /api/save-ak, users may end up storing long-lived credentials through a flow that appears operationally unrelated to supplier inquiry.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code exchanges an authorization code for access and refresh tokens and stores them locally, introducing sensitive token lifecycle handling that exceeds the skill's declared business purpose. If this component is triggered unexpectedly or bundled into a broader skill package, it can silently create durable authenticated access and increase the blast radius of compromise.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements credential and OAuth token revocation logic inside a skill whose declared purpose is procurement inquiry sourcing. That scope mismatch is dangerous because users or orchestrators may grant the skill more trust or permissions than warranted, enabling unexpected credential manipulation and account-impacting side effects unrelated to inquiry publishing.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The presence of OAuth token revocation and credential clearing capabilities is unjustified by the stated sourcing-inquiry function, creating hidden privileged behavior. In practice this can cause denial of service for the connected 1688 account, break other workflows that rely on the same tokens, and violate least-privilege expectations for the skill.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The documented and implemented command behavior is entirely about AK configuration, status, reset, and clearing rather than procurement inquiry creation or supplier matching. This mismatch indicates the shipped capability does something materially different from what the skill advertises, which undermines review, permission scoping, and user consent, and can conceal sensitive account-management actions inside an unrelated package.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This skill implements persistent access-key storage and retrieval logic even though the declared capability is a sourcing/inquiry workflow, creating a strong scope mismatch and increasing the likelihood of hidden or unnecessary credential handling. In an agent-skill context, unjustified secret-management functionality expands the attack surface and can enable unauthorized use of external services if the stored AK is later consumed elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The code persists an AK to disk and provides functions to check, configure, and remove it without showing why such a credential is necessary for this skill's stated role. Unnecessary secret-management capabilities are dangerous because they normalize collecting sensitive credentials and may support undocumented behavior beyond procurement inquiry.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The file identifies the skill as "1688-shopkeeper" while the provided metadata describes a different skill, which is a provenance and integrity red flag. Such mismatches can indicate code reuse across unrelated skills, hidden functionality, or packaging errors that make review and trust boundaries unreliable.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module-level documentation claims the writer preserves non-OAUTH_1688_ variables and only updates token-related keys, but write_env accepts and overwrites arbitrary keys from the caller and rewrites the full file. This mismatch can cause unintended modification of unrelated configuration or secrets, especially if other code trusts the documented restriction and passes unvalidated input.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This file implements an OAuth callback and token-exchange flow even though the declared skill is for 1688 sourcing/inquiry, not account authorization. That mismatch is security-relevant because it introduces credential-handling behavior outside the documented scope, making it easier to conceal unnecessary access to user accounts or tokens and harder for reviewers and users to assess whether the privilege is justified.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The page actively controls a localhost service by POSTing to /api/exchange and /api/shutdown, which is a privileged local capability not obviously required for a sourcing-inquiry skill. Even though it targets localhost, browser-driven requests to a local service can trigger sensitive actions without meaningful user verification, and the shutdown endpoint in particular creates an unnecessary control surface that could be abused if the local service lacks strict origin and CSRF protections.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The CLI prints access tokens in stdout JSON without any protection, warning, or containment, which can leak secrets to calling agents, shell history wrappers, logs, telemetry, or other downstream processors. Because bearer tokens grant account access directly, exposure can immediately enable unauthorized API actions within the token's scope.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/_const.py:98

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/callback_server.py:205

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/token_manager.py:53