search-1688-supplier

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:43 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed 1688 supplier-search helper that sends user searches, product links, or image URLs to AlphaShop using configured API keys.

Install only if you are comfortable sending supplier-search keywords, 1688 product IDs or links, and image URLs to AlphaShop. Use dedicated AlphaShop API keys, avoid confidential or internal-only URLs/images, and prefer a deployment process that pins or reviews dependency versions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README describes sending keywords, 1688 product links, and image URLs to an external AlphaShop API, but it does not clearly warn users that their inputs will leave the local environment and be disclosed to a third party. This can lead to unintentional sharing of sensitive business queries, private image URLs, internal product research, or tokenized links, especially because the skill auto-detects input type and encourages direct submission of user-provided content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly relies on environment variables containing API credentials and instructs the agent to make outbound AlphaShop API calls, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization gap: a host agent may permit env/network access implicitly, making credential use and external requests less auditable and easier to overgrant than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L008-L009 将技能适用场景描述为“查找1688供应商、搜索工厂、以图找商、找供应商、搜商家等场景”，其中“找供应商”“搜商家”等表述非常宽泛，缺少明确触发短语、上下文约束或排除条件。对于 markdown/manifest 类技能说明，这种模糊描述可能让路由器在普通采购对话中也误判应调用该技能。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L125-L141 规定展示结果时必须按固定格式输出，且整个技能文档仅以中文说明和中文字段展示要求约束代理行为，但未说明这是用户可选项，也未给出必须面向中文用户的政策性理由。该类自然语言约束可能导致技能在未获用户同意时强制使用特定语言/locale。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api.md (reported line 5)May include surrounding context.

md

import requests
import jwt

API_URL = "https://api.alphashop.cn/ai.select.provider.search/1.0"


def get_api_key():

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 16)May include surrounding context.

python

import requests
import jwt

API_URL = "https://api.alphashop.cn/ai.select.provider.search/1.0"


def get_api_key():

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 92)May include surrounding context.

python

import requests
import jwt

API_URL = "https://api.alphashop.cn/ai.select.provider.search/1.0"


def get_api_key():

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 109)May include surrounding context.

python

"Content-Type": "application/json"
    }
    try:
        resp = requests.post(detail_api, json={"productId": pid}, headers=headers, timeout=15)
        if resp.status_code == 200:
            data = resp.json()
            # Try to extract title and image from response

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.py (reported line 138)May include surrounding context.

python

if image_url:
        payload["searchImageUrl"] = image_url

    resp = requests.post(API_URL, json=payload, headers=headers, timeout=30)
    if resp.status_code != 200:
        print(f"Error: HTTP {resp.status_code}\n{resp.text[:500]}", file=sys.stderr)
        sys.exit(1)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.20.0), which makes builds non-reproducible and allows installation of unexpectedly old or newly introduced vulnerable versions depending on resolver behavior and environment. In a skill that performs external API access, requests is security-relevant because transport/authentication behavior directly affects confidentiality and integrity of outbound calls.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.20.0
PyJWT>=2.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a version, there is no way to verify that the deployed environment avoids affected releases. This is particularly relevant for a supplier-search skill that likely fetches remote URLs or talks to external services, where flaws in HTTP handling could expose credentials, weaken TLS validation behavior, or leak sensitive request data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is unpinned (PyJWT>=2.0.0), so the actual installed version is unverifiable and may vary across environments, including versions with security flaws. Because PyJWT is commonly used for token validation and signing, version drift here is more dangerous than a generic library issue: a vulnerable release could undermine authentication or trust decisions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.20.0
PyJWT>=2.0.0

Unverifiable Dependency: PyJWT has 16 known advisory(ies) (CVE-2026-32597 (PyJWT accepts unknown `crit` header extensions); CVE-2024-53861 (PyJWT Issuer field partial matches allowed); CVE-2026-48522 (PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token ) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

PyJWT has known security advisories, but the unpinned requirement prevents determining whether a safe version will be installed. In a skill that may authenticate to AlphaShop or process bearer tokens/JWT-based credentials, a vulnerable PyJWT version could lead to improper token validation, authentication bypass, or misuse of remote key retrieval features.

Content

No source excerpt is available for this finding.