ClawHub
Back to skill

Security audit

Smzdm Deals

Security checks for vulnerabilities and agentic risk

Overview

The skill is a shopping-deal helper, but it overstates live monitoring features and can show unlabeled fake deal results as if they were real.

Review this carefully before installing if you expect live, reliable deal information. It appears low-risk to your system, but its outputs may be inaccurate or simulated without warning; do not rely on it for purchase decisions unless the publisher fixes the mock fallback and documents exactly what data is live.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-21
Vulnerability Type: Supply-chain risk from an unpinned Python dependency
Risk Level: Medium

Vulnerable Code

yaml
"install":
  [
    {
      "id": "requests",
      "kind": "pip",
      "package": "requests",
      "label": "安装依赖：pip3 install requests",
    },
  ],

Technical Analysis

The skill declares requests as a pip dependency without specifying an audited version or package integrity hash. Consequently, the artifact installed in the future may differ from the artifact available when this skill was reviewed.

The package name is not an apparent typosquat, and the audit found no evidence that the current requests package is malicious. Nevertheless, unrestricted dependency resolution creates a supply-chain weakness: compromise of the package, one of its transitive dependencies, or the configured Python package index could cause attacker-controlled content to be installed.

Attack Path

  1. An attacker compromises the requests distribution, a resolved transitive dependency, or the package index configured in the target environment.
  2. A user or automation installs the skill dependencies.
  3. Pip resolves the unrestricted requests requirement to the attacker-controlled release.
  4. The malicious package is installed into the environment.
  5. Attacker-controlled code executes when the compromised component is imported or otherwise activated.

Impact Assessment

Successful exploitation could execute code with the privileges of the account installing or running the skill. Depending on those privileges, this could expose files, environment variables, API credentials, and network-accessible resources, or allow modification of the runtime environment.

This is a supply-chain exposure rather than evidence of an actively malicious dependency in the reviewed project.

Remediation
View remediation

Remediation Suggestions

  1. Pin requests to a specific, audited version rather than allowing unrestricted resolution.
  2. Maintain dependencies in a lock file generated from reviewed package versions.
  3. Require cryptographic hashes during installation, such as with pip's --require-hashes option.
  4. Use a trusted package index or an internally controlled package mirror.
  5. Regularly scan pinned direct and transitive dependencies for disclosed vulnerabilities.
  6. Review and deliberately update the lock file instead of automatically accepting new releases.

other

Warning
Location
tools/search_deals.py:36
Finding

Network Failures Are Silently Replaced with Fabricated Deal Results

Content
View full analysis

Vulnerability Details

File Location: tools/search_deals.py:36-49
Vulnerability Type: Misleading fabricated data and output-integrity failure
Risk Level: Medium

Vulnerable Code

python
# 什么值得买搜索 API（模拟）
search_url = f"https://search.smzdm.com/?c=home&s={keyword}"

try:
    response = requests.get(search_url, headers=HEADERS, timeout=15)
    response.raise_for_status()
    
    # 解析 HTML 提取优惠信息
    deals = parse_smzdm_html(response.text, keyword)
    return deals[:10]  # 限制返回 10 条
    
except requests.RequestException:
    # 返回模拟数据用于演示
    return get_mock_deals(keyword)

Related behavior in tools/search_deals.py:124-137 also returns mock data for the purported hot-deals feature while ignoring the requested category:

python
def get_hot_deals(category: str = "all", limit: int = 10) -> List[Dict[str, Any]]:
    """获取热门优惠"""
    categories = {
        "all": "全部",
        "digital": "数码",
        "home": "家居",
        "fashion": "服饰",
        "food": "食品",
        "beauty": "美妆",
    }
    
    # 返回模拟热门数据
    return get_mock_deals("热门商品")[:limit]

Technical Analysis

When the external request fails for any requests.RequestException, the program silently returns fixed demonstration records from get_mock_deals(). Those records contain invented prices, discounts, popularity values, merchant names, timestamps, and deal classifications such as “BUG price.” The formatted output does not mark these records as simulated.

The hot command also always produces mock records and does not use the selected category, despite exposing category selection as a supported feature. This contradicts the documented real-time monitoring, category filtering, historical-price comparison, and alerting behavior.

This is an integrity and trust issue rather than a route to system privileges. A remote service disruption, local network failure, DNS failure, timeout, or HTTP error can trigger authoritative-looking fabricated shopping information. ...[truncated 1274 chars]

Remediation
View remediation

Remediation Suggestions

  1. Return an explicit error when live retrieval fails instead of substituting demonstration data.
  2. If an offline demonstration mode is required, make it opt-in through a dedicated demo command or explicit flag.
  3. Prominently label every simulated record and the entire output as non-live demonstration data.
  4. Log or display the underlying request failure so users can assess result freshness and reliability.
  5. Implement actual hot-deal and category-filtering behavior, or remove those unsupported options and claims.
  6. Include data provenance and retrieval timestamps in live results.
  7. Add tests confirming that network failures never produce unlabeled mock records.
  8. Keep mock-data functions isolated from production retrieval paths to prevent accidental fallback behavior.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill promises real-time monitoring, BUG-price detection, history comparison, and category/sort logic that the implementation reportedly does not actually perform. This is a trust and integrity issue: users may act on fabricated or stale shopping data, and the gap between declared and actual behavior can conceal undisclosed processing or mislead users into risky decisions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill metadata declares required binaries and implies network use via curl/requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where the runtime may permit broader network access than users or hosting systems expect, reducing transparency and reviewability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad and shopping-related without clear activation boundaries, which can cause the skill to activate on loosely related user requests. Over-broad invocation can lead to unintended network queries, confusing responses, or accidental use in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level docstring states the tool purpose entirely in Chinese and presents the skill as a Chinese-language tool, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function signature and docstring at L020-L027 state that callers can choose sorting by hot/time/price. However, the sort parameter is never used in the request URL or in post-processing, so the actual behavior does not match the documented intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring says '获取热门优惠', suggesting real retrieval of hot deals, and the category map implies category-aware behavior. Instead, the function ignores the category value and simply returns mock deals for '热门商品', so the documented capability diverges from what the code actually does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

All user-facing natural-language content in the manifest and README is Chinese, and the file does not state that the skill is region-specific or provide an opt-in language/locale choice. That can violate language/locale policy when users are implicitly forced into a single language without consent or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The inline comment at L032 says this is a 'search API (simulated)', which implies an API-style integration. In reality, the code performs an HTTP GET to a website search page at L033-L036 and extracts deals by regex from HTML at L039-L040, which is a different implementation model than the comment describes.

Content

No source excerpt is available for this finding.