ClawHub
Back to skill

Security audit

Bupahua Store

Security checks for vulnerabilities and agentic risk

Overview

This store-search skill is mostly coherent, but it can capture broad shopping questions, send searches to an external service, and display misleading price comparisons.

Review this skill before installing. Use it only if you intend generic shopping questions to search the 不怕花 catalog, are comfortable sending product keywords to that service, and can protect the dedicated API key. The API endpoint should be pinned or allowlisted, and the price-formatting bug should be fixed before relying on displayed original-price comparisons.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:40
Finding

Broad activation rules force persistent commercial promotion into agent responses

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/search.py:59
Finding

API credentials can be redirected to an attacker-controlled endpoint

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/search.py:294
Finding

Product output fabricates and mislabels original prices

Content
View full analysis
0: price_str = f"¥{price_yh:.2f}" if price > 0 and price != price_yh: price_str += f" (原价 ¥{price:.2f})" ``` ### Technical Analysis The script initially reads the original price supplied by the API into `price`, but immediately overwrites it with `price_yh * 1.1`. This happens unconditionally, despite the comment suggesting that estimation should occur only when the original price is missing. The generated value is then labeled as the product’s original price. The output does not disclose that the value is estimated. This is a data-integrity flaw because the displayed comparison price is neither the API-provided original price nor a verified merchant value. ### Attack Path 1. The store API returns a product with a discounted price in `price_yh`. 2. The script reads any actual original price into `price`. 3. The script discards that value and generates a replacement equal to 110% of the discounted price. 4. The formatted response labels the synthetic value as the original price. 5. The user may interpret the fabricated comparison as a genuine historical or regular price when deciding whether to purchase the product. No separate attacker interaction is required; the issue occurs during normal Skill execution. ### Impact Assessment Users may be shown misleading discount information and make purchasing decisions based on a fabricated price comparison. The flaw affects the integrity and trustworthiness of every result with a positive discounted price. It does not provide filesystem access, code execution, credential access, or elevated system privileges. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 39)May include surrounding context.

python
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 46)May include surrounding context.

python
不怕花小龙虾商品技能 for OpenClaw Skill

API KEY 通过微信 "不怕花" 小程序获取 → 进入小程序后点击右下角 "我的" → "个人资料" (需要先完善个人资料)→ "API KEY" → 复制粘贴到 .env 文件

官方QQ群:654050824 <br/>
<img width="321" height="570" alt="不怕花龙虾群qrcode_1774315606023" src="https://github.com/user-attachments/assets/5081612b-9d59-4152-a541-38100185aae2" />

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search.py (reported line 48)May include surrounding context.

python
# 1. 尝试从 .env 文件加载（技能目录下）
        skill_dir = Path(__file__).parent.parent
        env_file = skill_dir / ".env"
        if env_file.exists():
            with open(env_file, encoding='utf-8') as f:
                for line in f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill invokes a local Python script and documents use of environment-based secrets plus outbound API access, but it does not declare any explicit tool scope or permissions. This weakens containment and reviewability because the runtime capabilities required by the skill are broader than what is transparently declared to the platform or user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger rules are broad enough to activate on generic shopping phrases like "有XXX吗" or "XXX多少钱", which can capture unrelated user requests and route them to this third-party store skill unexpectedly. That can cause unintended disclosure of user queries to an external service and degrade assistant integrity by hijacking normal conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description instructs use of an API key and external search API but does not warn that user queries will be transmitted to a third-party service. Without clear disclosure and consent, users may unknowingly send potentially sensitive shopping interests or product names off-platform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code presents its user-facing descriptions, errors, help text, and formatted output exclusively in Chinese. That creates a language/locale policy issue under the stated rule because users are not offered any opt-in or alternative language selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The formatting logic overwrites the actual product price with an invented value derived from the discounted price (price = price_yh * 1.1) and then presents it as an 'original price'. This causes users to receive false pricing information, which is especially risky in a shopping/search skill where users explicitly rely on accurate price and discount data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README content is entirely in Chinese and provides operational instructions only in that language, with no indication of alternative language support or user opt-in. Under the policy criteria, this is a natural-language locale constraint that is not documented as region-specific or optional.

Content

No source excerpt is available for this finding.