1688-supplychain-order-inquiry

• Outcome: Review
• Latest audit: Sep 4, 2026 · 3:29 AM UTC
• Version: 0.57.0

Overview

The skill mostly matches its stated 1688 order-inquiry and SKU-extraction purpose, but it needs Review because it can send merchant messages, change account-related settings, store access keys, silently report usage, and auto-install Python dependencies at runtime.

Install only if you are comfortable giving this skill access to your 1688 AK and letting it act on specified orders by sending merchant inquiries or changing inquiry dialogue settings. Review the AK storage behavior, the signed usage telemetry, and the automatic pip dependency repair path before use; keep order IDs, local attachment paths, and AK values limited to requests you explicitly intend to run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (76)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = "Bearer {}".format(token)
        resp = requests.patch("{}/api/config".format(gateway_url),
                             headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises substantial cross-platform supply-chain features, but the provided code chunk does not implement any of them. The only file shown is an empty __init__.py, which provides no order-processing, messaging, web extraction, parsing, or JSON-generation behavior. This is a material description-to-behavior mismatch because the actual code has effectively no functional capability matching the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述聚焦于订单询盘和电商商品链接的 SKU 提取，但实际代码既不处理订单/采购单，也不处理 Shopify/AliExpress 链接、SKU、变体或商家回复。相反，它访问本地文件系统读取图片，并调用图片上传接口获取 URL。这属于 materially different primary purpose，且使用了未声明的资源类型（本地图片文件与图片上传服务）。因此描述与代码行为明显不符。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 代码片段的实际职责是 telemetry/analytics 埋点，而不是声明中的订单询盘或电商商品 SKU 提取。它通过 api_post 调用远程接口 /api/alibaba.1688.report.skills.usage/1.0.0，上报 skill 名称、版本、场景和渠道等信息。这属于未在描述中声明的网络上报能力，且该代码片段本身的主要目的与所宣称的业务能力明显不一致。根据评估标准，这应判定为 description 与 behavior 不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a clear mismatch because the description advertises substantial cross-platform supply-chain functionality, but the provided code chunk does not implement any of it. The file is effectively empty (`__init__.py` with only an encoding header), so there is no observable behavior corresponding to the declared purpose. This is not a case of minor incompleteness or supporting code; the actual code lacks the primary capabilities entirely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises substantial cross-platform supply-chain assistant features, including order inquiry handling and SKU extraction from e-commerce links. However, the provided code chunk is effectively empty and contains no logic, API access, parsing, triggers, or resource usage related to those capabilities. Therefore, the actual behavior does not match the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是供应链业务能力：订单询盘与电商商品 SKU 提取；而实际代码完全没有订单、商家消息、Shopify、AliExpress、SKU 抓取或链接解析相关逻辑。相反，代码的核心功能是配置访问凭证 AK，包括读取现有配置、掩码显示、校验格式、写入网关或配置文件以及提示重载会话。这属于与声明用途明显不同的配置管理能力，且是未声明的主要功能，因此应判定为描述与行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述聚焦于供应链业务能力（订单询盘、回复查询、SKU 提取），而代码片段仅处理凭证配置：验证 AK 字符串、调用本地 Gateway 的 /api/config 接口写入配置、直接修改 openclaw.json、以及从环境变量或配置文件读取现有 AK。这不是对已声明能力的直接支撑实现，而是完全不同的配置子系统。代码中没有任何与订单、采购单、商家消息、Shopify、AliExpress、SKU 变体解析相关的逻辑，因此描述与实际行为存在明显且实质性的不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description advertises substantial cross-platform supply-chain functionality, including order inquiry handling and product SKU extraction. However, the provided code chunk is just an empty __init__.py file with no executable logic, resource access, trigger handling, or API interaction. Based on this chunk alone, the actual behavior does not match the declared capabilities because none of the promised functions are implemented or evidenced here.

Ae1

High

• Category: analysis-evasion

Content

- 域 B **不涉及** AK、网关、`cli.py`，不要为域 B 检查或引导配置 AK。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- 域 B **不涉及** AK、网关、`cli.py`，不要为域 B 检查或引导配置 AK。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ery` 的**纯 JSON 数组**（首字符 `[`，末字符 `]`），不得包裹代码块、不得附加汇总文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ery` 的**纯 JSON 数组**（首字符 `[`，末字符 `]`），不得包裹代码块、不得附加汇总文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ery` 的**纯 JSON 数组**（首字符 `[`，末字符 `]`），不得包裹代码块、不得附加汇总文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

文字或任何自然语言，与域 A 输出契约一致。具体格式见 `references/capabilities/sku_extract_shopify.md` / `sku_extract_aliexpress.md`。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

遇到 `success: false` 时（域 A），MUST 先阅读 `references/common/error-handling.md`，不要自行猜测错误原因。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The manifest describes a supply-chain assistant focused on order inquiries and SKU extraction from Shopify/AliExpress links. This file instead implements a standalone `configure` command for validating, reading, and writing an `AK` credential via gateway/file mechanisms, which is a separate credential-management capability not justified by the stated user-facing skill purpose.

Chaining Abuse

High

• Category: Tool Misuse

Content

}
  const command = isWin
    ? `setlocal enabledelayedexpansion & ${redirectedCmd} & echo !errorlevel! & type "${outF}" & echo. & echo __WFSE__: & type "${errF}" & del /f /q "${outF}" "${errF}"`
    : `${redirectedCmd}; _ec=$?; echo $_ec; cat "${outF}"; printf '\\n__WFSE__:'; cat "${errF}"; rm -f "${outF}" "${errF}"`
  return { command, timeout, description: description || `exec: ${program}` }
}

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The manifest describes an order inquiry workflow and AK/dialog configuration, but this code escalates to environment modification by invoking pip to install packages when a dependency is missing. Runtime package installation is not an obvious or declared part of fulfilling order inquiry requests and changes the host environment beyond the business function.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad phrases such as “帮我问商家”, “发货时间”, “什么时候发货”, and “商家回复”, which can occur in ordinary conversation and are not tightly scoped to explicit skill invocation. Although the file describes routing rules later, the trigger declaration itself does not provide negative examples or clear exclusion constraints, increasing the risk of accidental activation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The instruction says any user request bound to an order/purchase-order number and directed at a merchant counts as an inquiry, ‘不限表达形态’, including generic imperative text. This broad natural-language matching lacks negative examples or clearer boundaries for when similar phrases should not activate the skill, which can lead to over-triggering.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code performs telemetry reporting via `report_skill_usage()` and explicitly labels it as silent (`静默，不影响主流程`). There is no confirmation prompt, print/log disclosure, or visible warning in this file informing the user that usage data may be transmitted.

Static analysis

No suspicious patterns detected.