ozon-product-selection

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:31 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Ozon/1688 product-selection helper that uses AlphaShop API credentials and external searches, with documentation and dependency hygiene issues but no evidence of hidden, destructive, or deceptive behavior.

Install only if you are comfortable sending product search terms and product IDs to AlphaShop and using AlphaShop API credits. Store the access key and secret key as sensitive credentials, avoid committing them, rotate them if exposed, and consider pinning reviewed dependency versions before production use. Narrow or confirm generic requests like “帮我选品” to avoid accidental paid API use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code is clearly related to 1688/Ozon product sourcing, so it is not unrelated. However, the declared description promises a broader automated selection workflow: starting from a category, discovering market trends, extracting热门细分关键词, then searching and selecting products for each niche segment. The actual code only accepts one explicit query string, calls a single search API, applies straightforward numeric filters, and returns top offers plus SKU details. There is no logic for trend analysis, keyword mining, niche segmentation, or generating one optimal recommendation per niche market. Therefore the description materially overstates the implemented behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires access to environment secrets and external network resources but does not declare an explicit tool/permission scope. That creates an authorization gap where the runtime or reviewer cannot clearly constrain secret access and outbound calls, increasing the chance of unintended data exposure or overbroad execution. In this skill’s context, the risk is elevated because it explicitly asks for API keys and performs web/API lookups.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An overly broad trigger phrase like “帮我选品” can cause accidental invocation outside the intended Ozon/1688 context. That can lead to unintended web searches, API consumption, and use of configured credentials when the user did not mean to activate this skill, which is especially relevant because the skill can access secrets and paid external services.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

⚠️ **使用本 SKILL 前，必须先配置以下环境变量，否则1688搜索API调用会失败。**

| 环境变量 | 说明 | 必填 | 获取方式                                                                                                       |
|---------|------|------|------------------------------------------------------------------------------------------------------------|
| `ALPHASHOP_ACCESS_KEY` | AlphaShop API 的 Access Key | ✅ 必填 | 可以访问1688-AlphaShop（遨虾）来申请 https://www.alphashop.cn/seller-center/apikey-management ，直接使用1688/淘宝/支付宝/手机登录即可 |
| `ALPHASHOP_SECRET_KEY` | AlphaShop API 的 Secret Key | ✅ 必填 | 可以访问1688-AlphaShop（遨虾）来申请 https://www.alphashop.cn/seller-center/apikey-management ，直接使用1688/淘宝/支付宝/手机登录即可 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_products.py (reported line 17)May include surrounding context.

python

import time
import jwt

API_URL = "https://api.alphashop.cn/ai.select.provider.search/1.0"
DETAIL_API_URL = "https://api.alphashop.cn/alphashop.openclaw.offer.detail.query/1.0"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_products.py (reported line 18)May include surrounding context.

python

import time
import jwt

API_URL = "https://api.alphashop.cn/ai.select.provider.search/1.0"
DETAIL_API_URL = "https://api.alphashop.cn/alphashop.openclaw.offer.detail.query/1.0"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_products.py (reported line 48)May include surrounding context.

python

"intention": "SEARCH_OFFER",
        "query": query
    }
    resp = requests.post(API_URL, json=payload, headers=headers, timeout=30)
    if resp.status_code != 200:
        return {"error": f"HTTP {resp.status_code}", "detail": resp.text[:500]}
    data = resp.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_products.py (reported line 154)May include surrounding context.

python

"Content-Type": "application/json"
    }
    try:
        resp = requests.post(DETAIL_API_URL, json={"productId": str(product_id)},
                             headers=headers, timeout=15)
        if resp.status_code != 200:
            return []

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The argument help explicitly requires a Chinese search keyword, which imposes a language constraint in the user-facing interface. The file does not offer a language choice or explain a justified region-specific limitation, so this appears to be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README instructs users to place long-lived access credentials directly into configuration but provides no warning about secret sensitivity, storage hygiene, least-privilege use, or avoiding commits/logging. This increases the chance that users mishandle the keys, such as hardcoding them into tracked config files or sharing them in screenshots, backups, or support messages.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specifier requests>=2.20.0 is unpinned, so builds may resolve to different versions over time and may unexpectedly include vulnerable or incompatible releases. In a commerce automation skill that likely makes outbound HTTP requests, dependency drift can affect request handling, authentication, and transport security behavior.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.20.0
PyJWT>=2.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a version, there is no way to verify whether deployments will avoid affected releases. This is particularly relevant for a product-selection tool that likely consumes external APIs, since HTTP client flaws can expose credentials, weaken TLS verification, or mishandle attacker-controlled URLs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency specifier PyJWT>=2.0.0 is unpinned, which makes installations non-reproducible and leaves uncertainty about which security fixes are actually present. Because JWT libraries are commonly used for authentication and token validation, version drift can introduce subtle security regressions or leave known flaws unaddressed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.20.0
PyJWT>=2.0.0

Unverifiable Dependency: PyJWT has 16 known advisory(ies) (CVE-2026-32597 (PyJWT accepts unknown `crit` header extensions); CVE-2024-53861 (PyJWT Issuer field partial matches allowed); CVE-2026-48522 (PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

PyJWT has known advisories, but the unpinned requirement prevents verification that a safe version will be installed in every environment. In any workflow using bearer tokens, signing keys, or JWK retrieval, a vulnerable JWT library can affect token validation correctness and potentially enable authentication bypass or SSRF-related abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code sends the user-provided search query to an external API via requests.post, and later sends product identifiers to a second external API. While the module docstring describes searching products, there is no explicit user-facing warning, log, or comment near execution that the query data is transmitted to third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.