alphashop-sel-newproduct

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:31 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its credential handling and output-file handling need review before installation.

Install only if you trust the AlphaShop service and can protect the API keys. Avoid using the .env/source workflow, do not run test.sh with untrusted .env files, and treat generated report files as potentially sensitive business data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/selection.py:576

Finding

User-Controlled Output Path Traversal

Content

View full analysis

Vulnerability Details

File Location: scripts/selection.py:576-581 and scripts/selection.py:614-619
Vulnerability Type: Path traversal and uncontrolled file creation
Risk Level: Medium

Vulnerable Code

python

timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
filename = f"output/alphashop-sel-newproduct/keywords-{args.keyword.replace(' ', '-')}-{args.region}-{timestamp}.json"

import os
os.makedirs(os.path.dirname(filename), exist_ok=True)

with open(filename, "w", encoding="utf-8") as f:
    json.dump(result, f, ensure_ascii=False, indent=2)

The report command contains the same weakness:

python

timestamp = datetime.now().strftime("%Y%m%d-%H%M%S")
filename = f"output/alphashop-sel-newproduct/report-{args.keyword.replace(' ', '-')}-{args.country}-{timestamp}.json"

import os
os.makedirs(os.path.dirname(filename), exist_ok=True)

with open(filename, "w", encoding="utf-8") as f:
    json.dump(result, f, ensure_ascii=False, indent=2)

Technical Analysis

The user-controlled keyword argument is incorporated directly into a filesystem path. Replacing spaces with hyphens does not remove path separators, .. components, absolute-path syntax, or other filesystem metacharacters.

Both os.makedirs() and open(..., "w") operate on the resulting unverified path. Consequently, a keyword containing traversal components can escape output/alphashop-sel-newproduct. The generated timestamp makes exact replacement of a pre-existing file less practical, but it does not prevent directory traversal, creation of new files in unintended writable directories, or disclosure of API response data through an attacker-selected location.

Attack Path

1. An attacker or untrusted caller supplies a keyword containing traversal components, such as multiple ../ segments.
2. The keyword is sent to the fixed AlphaShop API as part of an otherwise legitimate request.
3. If the API accepts ...[truncated 1133 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use raw user input as part of a filesystem path.
• Convert keywords to a strict filename-safe identifier using an allowlist such as [A-Za-z0-9._-].
• Explicitly reject /, \, null bytes, absolute paths, and .. path components.
• Prefer a generated identifier, UUID, or cryptographic digest instead of the original keyword.
• Resolve both the base directory and candidate output path with pathlib.Path.resolve(), then verify that the candidate remains beneath the intended base directory before creating it.
• Apply the same centralized safe-path function to both the search and report commands.
• Create output files with restrictive permissions if responses may contain commercially sensitive information.

Example containment check:

python

from pathlib import Path
import re

output_root = Path("output/alphashop-sel-newproduct").resolve()
safe_keyword = re.sub(r"[^A-Za-z0-9._-]+", "-", args.keyword).strip(".-")
safe_keyword = safe_keyword or "keyword"

candidate = (
    output_root
    / f"keywords-{safe_keyword}-{args.region}-{timestamp}.json"
).resolve()

if output_root not in candidate.parents:
    raise ValueError("Invalid output path")

output_root.mkdir(parents=True, exist_ok=True)
with candidate.open("x", encoding="utf-8") as f:
    json.dump(result, f, ensure_ascii=False, indent=2)

T09 · Insecure Skill Coding Practices

Warning

• Location: test.sh:28

Finding

Arbitrary Shell Command Execution Through Dotenv Sourcing

Content

View full analysis

Vulnerability Details

File Location: test.sh:28-32
Vulnerability Type: Shell command execution through an untrusted configuration file
Risk Level: Medium

Vulnerable Code

bash

2)
    if [ -f ".env" ]; then
        echo "→ 加载 .env 文件..."
        source .env
        echo "✓ 凭证已加载"
    else
        echo "❌ .env 文件不存在"
        echo "   运行: cp .env.example .env 并编辑"
        exit 1
    fi
    ;;

Technical Analysis

The Bash source command does not parse .env as a passive key-value data file. It executes the entire file as shell code in the current shell context. A malicious or compromised .env can therefore contain command substitutions, shell functions, redirections, process launches, or arbitrary commands.

The path is relative to the current working directory, and the script does not verify the file's ownership, permissions, provenance, or syntax before executing it. Selecting the documented dotenv option therefore grants an attacker-controlled local file the full privileges of the user running test.sh.

Attack Path

1. An attacker places or modifies .env in the directory from which test.sh will be run.
2. The file includes valid-looking credential assignments together with malicious shell commands.
3. The user runs test.sh without already having both required credentials in the environment.
4. The script offers the dotenv configuration option, and the user selects option 2.
5. source .env executes every command in the malicious file within the test script's shell.
6. The attacker's commands run with all filesystem, network, and process privileges held by the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution as the account running the test script. The attacker can read or modify files accessible to that account, steal environment variables and AlphaShop credentials, issue network requests, alter project fi ...[truncated 232 chars]

Remediation

View remediation

Remediation Suggestions

• Never use source, ., or eval to load a dotenv file.
• Parse the file strictly as data using a trusted dotenv parser.
• Accept only the exact keys ALPHASHOP_ACCESS_KEY and ALPHASHOP_SECRET_KEY.
• Reject command substitutions, shell metacharacters, unexpected keys, multiline values, and executable statements.
• Resolve the dotenv path explicitly rather than relying on the caller's current working directory.
• Verify that the file is a regular file, is owned by the expected user, and is not writable by group or other users.
• Avoid running the test script with elevated privileges.
• Prefer injecting credentials through the documented Skill environment configuration rather than reading local dotenv files.

A safer approach is to invoke the Python program through a dotenv library that treats the file as key-value data, or to implement a strict parser that validates every line before exporting the two expected variables.

T09 · Insecure Skill Coding Practices

Note

• Location: test.sh:20

Finding

Interactive Secret Key Is Entered Without Terminal Echo Suppression

Content

View full analysis

Vulnerability Details

File Location: test.sh:20-25
Vulnerability Type: Plaintext secret exposure during interactive input
Risk Level: Low

Vulnerable Code

bash

1)
    echo ""
    read -p "请输入 ALPHASHOP_ACCESS_KEY: " ALPHASHOP_ACCESS_KEY
    read -p "请输入 ALPHASHOP_SECRET_KEY: " ALPHASHOP_SECRET_KEY
    export ALPHASHOP_ACCESS_KEY
    export ALPHASHOP_SECRET_KEY
    ;;

Technical Analysis

Bash read -p echoes entered characters to the terminal unless the -s option is used. The AlphaShop secret key is therefore displayed in plaintext while the user types it.

This exposure is especially relevant in shared workspaces, screen-sharing sessions, recorded terminals, remote support sessions, and environments where terminal output is captured. Although this issue does not transmit the secret by itself, it unnecessarily increases credential exposure and exceeds the minimum visibility required for authentication.

Attack Path

1. The user runs test.sh without credentials already configured.
2. The user chooses manual credential entry.
3. The script prompts for ALPHASHOP_SECRET_KEY using ordinary echoed input.
4. The secret appears visibly in the terminal.
5. A nearby observer, screen-recording tool, screen-sharing participant, or terminal-capture mechanism obtains the credential.

Impact Assessment

Disclosure of the secret key may allow unauthorized AlphaShop API authentication, consumption of the victim's API quota, access to data available to that credential, or actions permitted by the associated AlphaShop account.

The exact external API privileges cannot be determined from the repository. The issue does not directly provide local operating-system privileges.

Remediation

View remediation

Remediation Suggestions

• Read the secret with terminal echo disabled:

bash

read -p "Enter ALPHASHOP_ACCESS_KEY: " ALPHASHOP_ACCESS_KEY
read -rsp "Enter ALPHASHOP_SECRET_KEY: " ALPHASHOP_SECRET_KEY
echo

• Prefer noninteractive secret injection through the Skill's protected environment configuration.
• Do not print, log, or include the secret in error messages.
• Unset temporary credential variables after the test completes if they are no longer required.
• Warn users against entering secrets during screen sharing or terminal recording.
• Ensure any configuration file containing credentials has restrictive permissions and is excluded from version control.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tainted flow: 'token' from os.environ.get (line 137, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/selection.py (reported line 193)May include surrounding context.

python

print(f"→ 正在搜索关键词: {keyword} @ {platform.upper()} {region}")
        print(f"→ 请求中... (响应时间约10秒内)")

        response = requests.post(
            KEYWORD_SEARCH_ENDPOINT,
            json=payload,
            headers={

Tainted flow: 'token' from os.environ.get (line 137, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/selection.py (reported line 301)May include surrounding context.

python

print(f"→ 正在生成报告: {keyword} @ {platform.upper()} {country}")
        print(f"→ 请求中... (响应时间约几十秒)")

        response = requests.post(
            REPORT_ENDPOINT,
            json=payload,
            headers={

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instructions direct the user to create a .env file containing real API secrets. Secret files are commonly exposed through accidental commits, backups, editor plugins, or weak filesystem controls, so documenting this without safeguards creates a real credential exposure risk.

Content

Scanner excerpt · QUICKSTART.md (reported line 35)May include surrounding context.

bash

# 复制示例文件
cp .env.example .env

# 编辑 .env 文件，填入真实凭证
vim .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The step to edit .env and place live credentials into it normalizes storing plaintext secrets locally without warning users about leakage paths. If those credentials are exposed, an attacker could authenticate to the AlphaShop API and abuse the account or access associated data.

Content

Scanner excerpt · QUICKSTART.md (reported line 37)May include surrounding context.

md

# 复制示例文件
cp .env.example .env

# 编辑 .env 文件，填入真实凭证
vim .env

# 加载环境变量

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The instruction to load the .env file after populating it continues the plaintext-secret workflow and may encourage unsafe operational habits. In practice, these files are often retained, copied, or inadvertently disclosed, making credential theft more likely in development and shared environments.

Content

Scanner excerpt · QUICKSTART.md (reported line 38)May include surrounding context.

md

cp .env.example .env

# 编辑 .env 文件，填入真实凭证
vim .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The command to source a .env file imports secrets into the current shell environment, where they may be inherited by child processes, surfaced in debugging output, or handled insecurely on shared systems. In the context of an ecommerce analysis skill requiring external API access, stolen keys could enable unauthorized API use and possible access to commercial data or quota abuse.

Content

Scanner excerpt · QUICKSTART.md (reported line 41)May include surrounding context.

vim .env

加载环境变量

source .env

text

### 方式B：OpenClaw 配置（推荐）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test.sh (reported line 15)May include surrounding context.

sh

echo ""
    echo "请选择配置方式："
    echo "  1) 手动输入（本次有效）"
    echo "  2) 使用 .env 文件"
    echo "  3) 退出"
    echo ""
    read -p "请选择 [1-3]: " choice

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test.sh (reported line 30)May include surrounding context.

sh

echo ""
    echo "请选择配置方式："
    echo "  1) 手动输入（本次有效）"
    echo "  2) 使用 .env 文件"
    echo "  3) 退出"
    echo ""
    read -p "请选择 [1-3]: " choice

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test.sh (reported line 31)May include surrounding context.

sh

echo ""
    echo "请选择配置方式："
    echo "  1) 手动输入（本次有效）"
    echo "  2) 使用 .env 文件"
    echo "  3) 退出"
    echo ""
    read -p "请选择 [1-3]: " choice

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test.sh (reported line 34)May include surrounding context.

sh

echo ""
    echo "请选择配置方式："
    echo "  1) 手动输入（本次有效）"
    echo "  2) 使用 .env 文件"
    echo "  3) 退出"
    echo ""
    read -p "请选择 [1-3]: " choice

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test.sh (reported line 35)May include surrounding context.

sh

echo ""
    echo "请选择配置方式："
    echo "  1) 手动输入（本次有效）"
    echo "  2) 使用 .env 文件"
    echo "  3) 退出"
    echo ""
    read -p "请选择 [1-3]: " choice

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The script executes source .env, which treats the .env file as shell code rather than inert configuration data. If a malicious or modified .env file is present, arbitrary commands can run in the user's shell context, potentially exposing credentials or compromising the workstation.

Content

Scanner excerpt · test.sh (reported line 29)May include surrounding context.

sh

export ALPHASHOP_SECRET_KEY
            ;;
        2)
            if [ -f ".env" ]; then
                echo "→ 加载 .env 文件..."
                source .env
                echo "✓ 凭证已加载"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quickstart explicitly tells users to place long-lived API credentials into environment variables, a local .env file, and a persistent OpenClaw config file, but gives no guidance on file permissions, avoiding source control, shell history exposure, or secret rotation. This is not inherently malicious, but it increases the likelihood of accidental credential leakage through checked-in files, shared home directories, process inspection, or support logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README tells users to place an access key and secret key into configuration but provides no warning that these are sensitive credentials, no guidance on secure storage, and no caution against committing them to source control or logs. In a skill ecosystem where users may copy examples directly, this increases the chance of credential leakage through config files, screenshots, shell history, shared repos, or support bundles.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents use of environment variables, network access to external APIs, and writing output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may grant broader capabilities than users expect, weakening reviewability and increasing the chance of unintended secret exposure or external data transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The natural-language content of the skill, including its description, setup, usage, warnings, and examples, is presented in Chinese only. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not documented here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill transmits user-supplied market research queries and potentially credential-authenticated requests to an external domain, which is a real data egress surface. In context this is expected functionality, but it still carries risk because the skill lacks explicit scoping and does not clearly describe what data is sent, how it is protected, or whether secrets are included in requests.

Content

Scanner excerpt · SKILL.md (reported line 457)May include surrounding context.

md

| 接口 | 方法 | URL | 响应耗时 |
|------|------|-----|---------|
| 关键词搜索API | POST | `https://api.alphashop.cn/opp.selection.keyword.search/1.0` | 10秒内 |
| 新品报告API | POST | `https://api.alphashop.cn/opp.selection.newproduct.report/1.0` | 10秒内 |

## 注意事项

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The second external API endpoint represents the same class of risk: outbound transmission of user inputs and generated report parameters to a third-party service. Because this endpoint produces deeper reports and may include more filtering parameters, it increases the amount of business data disclosed externally if not properly scoped and disclosed.

Content

Scanner excerpt · SKILL.md (reported line 458)May include surrounding context.

md

| 接口 | 方法 | URL | 响应耗时 |
|------|------|-----|---------|
| 关键词搜索API | POST | `https://api.alphashop.cn/opp.selection.keyword.search/1.0` | 10秒内 |
| 新品报告API | POST | `https://api.alphashop.cn/opp.selection.newproduct.report/1.0` | 10秒内 |

## 注意事项

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation contradicts itself by first requiring ALPHASHOP_ACCESS_KEY and ALPHASHOP_SECRET_KEY, then later claiming the API is public and needs no authentication. This can mislead operators into misconfiguring the skill, normalizing unsafe handling of credentials, or sending requests under false assumptions about authentication and data protection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 10)May include surrounding context.

md

**请求方式**: POST
**Content-Type**: application/json
**响应耗时**: 几十秒（同步返回）
**Endpoint**: `https://api.alphashop.cn/opp.selection.newproduct.report/1.0`

## 请求参数

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/selection.py (reported line 193)May include surrounding context.

python

print(f"→ 正在搜索关键词: {keyword} @ {platform.upper()} {region}")
        print(f"→ 请求中... (响应时间约10秒内)")

        response = requests.post(
            KEYWORD_SEARCH_ENDPOINT,
            json=payload,
            headers={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/selection.py (reported line 301)May include surrounding context.

python

print(f"→ 正在生成报告: {keyword} @ {platform.upper()} {country}")
        print(f"→ 请求中... (响应时间约几十秒)")

        response = requests.post(
            REPORT_ENDPOINT,
            json=payload,
            headers={

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments, prompts, and status messages are presented entirely in Chinese, with no language selection or documented locale constraint. This can violate language/locale policy when users are not given a choice or prior opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads ALPHASHOP_SECRET_KEY using plain read, so the secret is echoed to the terminal and may be exposed to shoulder-surfing, screen recording, terminal logging, or session capture. This is a real credential-handling weakness even in a local test script because it unnecessarily increases the chance of secret disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Natural-language policy issues apply to all file types, including markdown. This quickstart forces a single language/locale presentation with no user opt-in or explanation that the skill is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.