other
Error
- Location
references/capabilities/sku_extract_aliexpress.md:22- Finding
Hidden Unicode Variation-Selector Obfuscation in Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
1688-supplychain-order-inquiry
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated business purpose, but it needs review because it handles credentials and local files, can install packages during use, and contains hidden Unicode in agent instructions.
Install only after review or remediation. Users should be aware this skill can send merchant inquiries, change inquiry automation settings, store and use a 1688 access key, upload local files, report usage metadata, fetch product pages, and install packages during execution. The highest-priority fixes are removing hidden Unicode from instruction files, disabling automatic dependency installation, restricting local uploads to validated image attachments, validating gateway and product-fetch destinations, and hardening AK storage.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/_img_upload.py:34- Finding
Arbitrary Local File Read and Remote Disclosure Through Image Upload
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/capabilities/sku_extract_shopify.md:236- Finding
Server-Side Request Forgery in the Documented Shopify HTTP Fallback
- Content
View full analysis
，非 Shopify 商品页"} # ── 方法1：product.json API（推荐） ── json_url = f"{parsed.scheme}://{parsed.netloc}{path}.json" try: resp = requests.get(json_url, headers=headers, timeout=timeout) if resp.status_code == 200: product = resp.json().get("product", {}) return _parse_product(product) except requests.RequestException: pass # ── 方法2：从 HTML 页面内嵌 JSON 提取 ── page_url = f"{parsed.scheme}://{parsed.netloc}{path}" try: resp = requests.get( page_url, headers={**headers, "Accept": "text/html"}, timeout=timeout, ) resp.raise_for_status() html = resp.text ``` ### Technical Analysis The fallback validates only that the path begins with `/products/`. It does not validate the URL scheme or destination host before making a server-side request. Consequently, values such as these satisfy the path check: ```text http://127.0.0.1/products/test http://169.254.169.254/products/test http://internal-service.local/products/test ``` `requests.get()` follows redirects by default. Even if an initial public hostname were required later, an attacker-controlled redirect could still target loopback, private, link-local, or cloud-metadata addresses unless every redirect destination is revalidated. This script is embedded in a capability reference that instructs the Agent to create and execute it when browser tooling is unavailable. The vulnerability therefore becomes reachable when the documented fallback is followed. ### Attack Path 1. An attacker provides a URL whose path begins with `/products/` bu ...[truncated 1103 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
workflow/order-inquiry.js:463- Finding
Automatic Runtime Installation of Unpinned Dependencies
- Content
View full analysis
⚠️ 检测到缺失 Python 依赖，正在安装后重试...') const retryShell = `python3 -m pip install -r ${shellEscape(baseDir + '/requirements.txt')} && python3 ${shellEscape(CLI_SCRIPT)} ${cliArgs.map(a => shellEscape(String(a))).join(' ')}` const retryRaw = await callTool('Bash', buildBashCommand('sh', ['-c', retryShell], '安装依赖并重试', 300000)) cliOut = parseCliOutput(parseBashOutput(retryRaw), intent.command) } ``` The dependency specification is open-ended: ```text requests>=2.28.0 ``` The capability references also instruct runtime installation without version or artifact verification: ```bash pip install playwright playwright install chromium ``` ```bash pip install requests ``` ### Technical Analysis When a Python import fails, the workflow automatically invokes pip and then retries the original command. The dependency uses a minimum-version constraint rather than an exact reviewed version, and no hashes are supplied. As a result, installation behavior depends on mutable package-index state at execution time. A future compromised release, package-index compromise, malicious mirror, or altered package source can change the code installed after the Skill itself has already been reviewed. The Playwright fallback additionally downloads a Chromium artifact without a project-controlled digest. ### Attack Path 1. The runtime does not have a required Python package installed. 2. The first CLI invocation fails with `Module ...[truncated 1003 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/capabilities/configure/service.py:35- Finding
API Key Can Be Sent to an Unrestricted Gateway URL and Stored Without Explicit Permission Hardening
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (66)
Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The code takes OPENCLAW_GATEWAY_URL directly from the environment and uses it as the destination for a PATCH request that includes the API key in the JSON body and possibly a bearer token in headers. If an attacker can influence the environment or runtime configuration, credentials can be exfiltrated to an arbitrary endpoint; the default also permits plain HTTP, increasing interception risk.
- Content
python headers = {} if token: headers["Authorization"] = "Bearer {}".format(token) resp = requests.patch("{}/api/config".format(gateway_url), headers=headers, json=payload, timeout=5) return resp.ok except Exception:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This combines two material concerns: missing advertised SKU extraction and undocumented AK configuration. Undisclosed credential-handling functionality is more dangerous in this skill context because the skill presents itself as a business workflow helper, so users may not expect secret persistence or platform configuration changes as part of its operation.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
js } const command = isWin ? `setlocal enabledelayedexpansion & ${redirectedCmd} & echo !errorlevel! & type "${outF}" & echo. & echo __WFSE__: & type "${errF}" & del /f /q "${outF}" "${errF}"` : `${redirectedCmd}; _ec=$?; echo $_ec; cat "${outF}"; printf '\\n__WFSE__:'; cat "${errF}"; rm -f "${outF}" "${errF}"` return { command, timeout, description: description || `exec: ${program}` } }
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The workflow automatically runs
python3 -m pip install -r ...when it detects a missing module, which gives the skill runtime package-install capability on the host. This expands the skill far beyond order inquiry functionality and can execute arbitrary install-time code from dependencies or altered package indexes, making compromise of the environment possible without explicit user approval.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Overly broad trigger phrases like everyday shipping or inquiry language can cause accidental activation of a skill that performs external actions such as contacting merchants or changing inquiry state. In an agent setting, false activations are dangerous because they can send unintended messages, expose order data, or execute workflows without sufficiently explicit user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文档中的用户可见进度话术和操作说明均固定为中文，例如“正在查询商家回复，请稍等...”和“正在为您配置对话能力，请稍等...”，但没有说明可根据用户语言偏好切换。若面向多语言用户，这构成未获用户选择的语言/locale 约束。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The CLI performs telemetry reporting via
_tracker.report_skill_usage()after executing the requested command, but this behavior is not disclosed in the interface or module description. Silent data collection in a supply-chain/order workflow is security-relevant because it may leak usage metadata, order-related context, or environment details to an undeclared sink, violating least surprise and potentially compliance requirements.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Telemetry is sent silently and failures are suppressed, which prevents users from knowing that usage reporting exists and makes the behavior hard to audit. In the context of a procurement/order inquiry skill, even metadata about command invocation can be sensitive because it may reveal business operations, supplier interactions, or usage patterns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation instructs users to pass an AccessKey directly on the command line and shows it being persisted, but it does not warn that command-line arguments and stored secrets may be exposed through shell history, process listings, logs, or insecure local storage. In a skill whose primary function depends on authenticated access to a supplier platform, mishandling this credential could allow account misuse, unauthorized order inquiries, or access under the buyer identity automatically derived by the gateway.
- Content
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
- Content
md ### 参数表 | 参数 | 说明 | | --------------- | ---------------------------------------------------------------------------------------- | | `--multi-round` | 多轮对话开关（flag，默认关闭）。用户**明确要求支持多轮对话/AI 自动多轮回复**时加此参数（`orderSingleRound=false`）；不加则默认单轮（`orderSingleRound=true`） |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill title and core behavior are specified entirely in Chinese, and the instructions mandate a fixed output format and interaction style without giving the user any language or locale opt-in. Under the policy, forcing a specific language is a natural-language policy violation unless the skill offers a choice or clearly justifies the locale constraint.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file's HARD RULE requires the final message to contain only a bare JSON array with no surrounding text or section markers (L104-L109). Line L117 then instructs that when multiple links are provided, results should be output in separate sections labeled by product link or title, which directly conflicts with the earlier output-only-JSON requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructions are written entirely in Chinese and prescribe exact output/error phrasing in Chinese, such as telling the agent to explain failures to the user in Chinese. There is no user opt-in or alternative language path, which conflicts with the language/locale policy for natural-language behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file repeatedly states that final output must be only a raw JSON array with no extra text, and line L124 says any extra fields are ignored while L142 explicitly forbids appended natural language. However, the script prints a summary such as '共 N 个 SKU' after the JSON, which directly contradicts the documented output contract and changes the actual emitted output format.
- Content
Static analysis
No suspicious patterns detected.