Security audit

alphashop-sel-product-search

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly implements a product-search API client, but its package under-discloses credentials and network behavior and includes conflicting image-search documentation that broadens what users may think they are installing.

Review this before installing. Use it only if you trust AlphaShop/1688 with your product-search queries and can provide credentials through protected environment configuration. Avoid command-line secrets, do not use the plaintext HTTP reference examples with real data, and treat the bundled image-search documentation as an unresolved scope mismatch until the publisher clarifies or removes it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/search.py:139
Finding: API Authentication Is Optional and User Identity Is Caller-Controlled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/search.py:292
Finding: AlphaShop Secret Key Can Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/api.md:175
Finding: Reference Examples Transmit API Request Data over Plaintext HTTP
Content: View full analysis
res.json()) .then(data => console.log(JSON.stringify(data, null, 2))); ``` ### Technical Analysis Both examples send product-search input and a user identifier over plaintext HTTP. HTTP provides neither transport confidentiality nor server authenticity nor integrity protection. An attacker with an on-path position can observe the request, alter the service name, method, parameters, or identity, and modify the response returned to the cal ...[truncated 1650 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose says this is a product search skill, but the behavior described goes beyond that by using undeclared JWT credential handling, possible local persistence of full API responses, and exposing broader supplier/reference data. This mismatch is dangerous because reviewers and users may authorize the skill under a narrower trust assumption while it actually handles secrets, writes data locally, and sends/returns more information than expected.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file documents an image-based product recall API while the skill metadata says the skill is for keyword-based product search. This capability mismatch is dangerous because it can hide undeclared functionality, expand the data handled by the skill (image URLs, embeddings, supplier data), and bypass user or reviewer expectations about what the skill actually does.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The security section says userId is required for identity verification, but the shown validation code never checks for userId presence or authenticity. This creates an authentication/authorization gap where requests may be processed without a verified caller, undermining access control, auditing, and abuse prevention.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The referenced documentation describes an image-based product recall API, while the skill manifest claims a keyword-based product search capability. This kind of capability/documentation mismatch can cause an agent or integrator to invoke an unintended interface, send the wrong classes of user data, and apply incorrect safety assumptions, which is a real security and integrity problem rather than a harmless documentation bug.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file documents and tests an image-based product recall API while the skill is declared as a keyword-based product search skill. This capability mismatch can mislead users, downstream agents, or reviewers into invoking unintended functionality, expanding the skill’s effective scope and potentially enabling unreviewed data flows such as external image fetching.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation indicates capabilities involving environment secrets, network access, and possible file writes, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege failure: operators and policy engines cannot accurately constrain or review what the skill may do, increasing the chance of unintended secret access, external transmission, or local persistence.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest metadata says no environment variables are required, while the documentation requires API credentials via environment/config. This discrepancy can lead to insecure deployments, ad hoc secret handling, and failed policy validation because secret dependencies are hidden from the formal metadata.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 73% confidence
Finding: This skill performs external network transmission to a third-party production endpoint, which is a genuine security-relevant behavior even if it is core to the skill's function. In context this is expected rather than malicious, but it still creates data exposure and dependency risk because user queries and related metadata leave the local trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 382)May include surrounding context.
md
### 商品搜索 API - **接口地址**：`POST https://api.alphashop.cn/ai.sel.global1688.productSearchApi/1.0` - **环境**：生产环境（Production） - **认证方式**：JWT Token (HS256) - **请求格式**：JSON

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill sends user-supplied search queries and filters to an external production API, but the description does not clearly warn users about this external transmission. That omission matters because product queries may contain sensitive business research, strategy, or proprietary market interests, and users cannot make an informed consent decision without disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The curl example sends data to an internal endpoint over plain HTTP, exposing request contents to interception or tampering on the network path. Even though the sample payload is simple, real usage could include sensitive search terms, internal identifiers, or business intelligence queries.
Content: Scanner excerpt · references/api.md (reported line 175)May include surrounding context.
调用示例

使用curl

bash
curl -X POST "http://pre-cbucrm.alibaba-inc.com/api/hsf-test/invoke" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples instruct users to send search queries and parameters to an internal endpoint without any warning about data transmission, environment sensitivity, or handling of potentially sensitive business queries. This can cause inadvertent disclosure of user-entered data to internal services, especially when copied into scripts or shared environments.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The browser fetch example transmits request data to an internal HTTP endpoint, which is risky because it uses plaintext transport and encourages execution from a browser context. This increases exposure of business queries, identifiers, and responses to interception, mixed-content issues, and accidental use from unmanaged client environments.
Content: Scanner excerpt · references/api.md (reported line 211)May include surrounding context.
使用JavaScript（浏览器Console）

javascript
fetch("http://pre-cbucrm.alibaba-inc.com/api/hsf-test/invoke", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a narrowly scoped 商品搜索 API skill for keyword-based product discovery, but the file's whitelist guidance explicitly includes additional methods keywordSearchApi and newProductReportExecuteApi. In particular, newProductReportExecuteApi suggests a separate report-execution capability that is not part of the declared search-only purpose, indicating broader behavior than the skill claims.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The API response includes supplier identifiers and names even though the stated skill purpose is product search, not supplier discovery. Exposing extra business-partner data without clear necessity violates data minimization and can leak internal or sensitive commercial relationships to external callers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The request logging example records the full imageUrl, which may contain personal data, tracking parameters, signed object-store links, or confidential resource locations, and the document does not mention user notice or minimization. Logging such URLs increases exposure in log pipelines, support systems, and audit stores beyond the primary business need.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document claims an image URL whitelist mechanism, but the provided validation only checks whether the URL is syntactically valid. If the service fetches arbitrary user-supplied URLs, this can enable server-side request forgery or access to unintended internal or restricted resources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document instructs users to submit imageUrl and userId to a backend API but does not disclose that these identifiers and referenced image resources are transmitted to external services for processing. That omission can lead users or agent developers to handle personal or sensitive data without informed consent, minimization, or policy controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Requiring the image to be publicly accessible creates a privacy and data-exposure risk because users may publish otherwise private assets or stable URLs to third-party-accessible locations. Without warning or compensating controls, this encourages insecure sharing patterns and may expose sensitive content, tokens embedded in URLs, or business-confidential product images.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HSF example explicitly invokes imageSearchApi and constructs an ImageSearchApiRequest, contradicting the surrounding keyword-search skill context. This increases the chance that downstream users or code-generation agents will call the wrong backend method and transmit image URLs or other data to an unintended service, creating a concrete misuse path.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The testing scope repeatedly frames the feature as image product recall/search, contradicting the stated keyword-search intent of the skill. Such contradictory documentation increases the chance of confused-deputy behavior, incorrect trust assumptions, and accidental exposure of broader functionality than users or policy engines expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level docstring describes the script as calling a product search service, while the manifest says the skill searches Amazon/TikTok products. However, the actual endpoint string targets global1688.productSearchApi, and the response formatter explicitly outputs 1688 同款参考价, showing the implementation is tied to 1688-related data as well. This is an active documentation/intent mismatch rather than a mere omission.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and all user-facing CLI messages are written in Chinese, and the script does not provide any user opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/图片商品召回接口技术设计文档.md (reported line 46)May include surrounding context.
md
import jwt # AlphaShop API 配置 API_ENDPOINT = "https://api.alphashop.cn/ai.sel.global1688.productSearchApi/1.0" # API 认证配置（需要从环境变量或配置文件获取） APP_KEY = None # 需要配置

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/图片商品召回接口文档.md (reported line 20)May include surrounding context.
md
import jwt # AlphaShop API 配置 API_ENDPOINT = "https://api.alphashop.cn/ai.sel.global1688.productSearchApi/1.0" # API 认证配置（需要从环境变量或配置文件获取） APP_KEY = None # 需要配置

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search.py (reported line 18)May include surrounding context.
python
import jwt # AlphaShop API 配置 API_ENDPOINT = "https://api.alphashop.cn/ai.sel.global1688.productSearchApi/1.0" # API 认证配置（需要从环境变量或配置文件获取） APP_KEY = None # 需要配置

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Description-Behavior Mismatch

Intent-Code Divergence

Description-Behavior Mismatch

Description-Behavior Mismatch

Undeclared Tool Scope

Scope Creep

External Transmission

Missing User Warnings

External Transmission

调用示例

使用curl

Missing User Warnings

External Transmission

使用JavaScript（浏览器Console）

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Intent-Code Divergence

Intent-Code Divergence

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

Static analysis