Security audit
Security checks for vulnerabilities and agentic risk
This shopping assistant needs review because it can expose your access secret and forward private message content to its shopping service.
Wait for HTTPS-only connections to a verified service, protected credential setup and storage, and redaction before forwarding shopping messages. Avoid pasting secrets into chat. Rotate the secret if you already used this version with its default connection.
scripts/shihuo_api.pyBearer credentials transmitted over plaintext HTTP by default
An on-path observer can obtain the Access Secret and replay it to invoke API capabilities granted to that credential. An active attacker can also alter returned prices or purchase links.
The request sends the file-backed Access Secret and embedded API key over plain HTTP by default, exposing credentials and shopping queries to network interception and response tampering. SHIHUO_MCP_ENDPOINT also accepts an arbitrary destination without validation, so an attacker able to influence that environment variable can redirect authenticated requests to a server they control; ordinary shopping API access does not require either exposure.
},
)
try:
with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
body = response.read().decode("utf-8", errors="replace")
except urllib.error.HTTPError as exc:
return None, _http_error(exc)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
场景判定顺序以 `SKILL.md` 的「意图识别与场景匹配」为准。回复格式以对应场景包的 `output.md` 为准，章节清单、模块顺序和模块骨架强制执行。
识货工具不通过 MCP 连接，由 `scripts/shihuo_api.py` 直接调用识货开放平台 `sh.mcpapi`。Access Secret 存在 `assets/authorization.txt`，每个 Session 首次调用工具前先读凭证、再验证，验证失败时提示用户去[识货开放平台](https://www.shihuo.cn/page/openPlatform)申请并覆盖写入该文件。
## 目录
The documented design stores a reusable Access Secret as plaintext inside the skill directory and has the agent write it at runtime. This creates a credential-exposure risk through workspace access, backups, accidental packaging, or agent context, although actual exploitability depends on file permissions and runtime isolation that are not shown. Excluding the file from the distributed package reduces initial exposure but does not protect credentials created after installation.
- `references/scenarios/link-coupon/`：链接与优惠流程、标准模板、追问和兜底。
- `references/tools/`：工具入参、响应字段、前置条件和调用约束。
- `assets/tools.json`：工具 Schema 镜像，以服务端定义为准。
- `assets/authorization.txt`：Access Secret，单行明文，运行时由 Agent 写入；不随包提交。
- `scripts/shihuo_api.py`：运行时调用识货开放平台的命令行入口。
- `scripts/validate_skill.py`：维护时检查包结构、frontmatter、工具镜像、场景包和相对引用，不参与运行时流程。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 许可
本技能包以 MIT-0 许可公开发布，完整条款见 `LICENSE`。调用识货开放平台仍需申请有效的 Access Secret，并遵守服务端鉴权、限流和业务规则；技能包许可不授予接口访问权限。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
report.add_error(
"secret_in_package",
"assets/authorization.txt",
"包内不得携带 Access Secret，发布前清空或删除该文件",
)
for name in REQUIRED_TOOLS:
if not (root / "references" / "tools" / f"{name}.md").is_file():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python3 scripts/shihuo_api.py call <tool_name> --args-file <path>
python3 scripts/shihuo_api.py call <tool_name> --args-file - # 从标准输入读 JSON
Access Secret 只从 <skill_root>/assets/authorization.txt 读取：不接受命令行参数，
不打印到标准输出或标准错误，避免进入 Shell 历史、进程列表和日志。
输出固定为单个 JSON 对象：
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def read_secret() -> tuple[str, dict[str, Any] | None]:
"""读取并规范化 Access Secret，不回显内容。"""
if not SECRET_PATH.is_file():
return "", {
"code": "missing_secret",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if exc.code == 403:
return {
"code": "secret_rejected",
"message": detail or "Access Secret 已被禁用或当前用户无权调用，服务端返回 403",
"exit": EXIT_INVALID_SECRET,
}
return {
The supplied chunk implements a standalone skill-metadata utility, with no product recommendation, search, pricing, purchasing-link, or coupon functionality. Although such parsing could support a larger skill framework, this chunk provides no connection to the declared shopping workflow. The mismatch is functional, not evidence of malicious behavior; no network activity, transactions, or data exfiltration are shown.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## 识货开放平台与前置认证流程
识货工具不通过 MCP 连接，统一由 `scripts/shihuo_api.py` 直接调用识货开放平台 `sh.mcpapi`。该脚本从 `assets/authorization.txt` 读取 Access Secret，每个 Session 第一次要调用识货工具前必须先完成认证，认证通过后同一 Session 内不再重复验证。
### 三步认证
Reading an existing service credential is legitimate, but this instruction also directs the agent to collect a missing credential through chat and write it into the skill directory. That insecure provisioning path duplicates the credential-exposure issue in SQP-2 rather than establishing malicious credential access.
### 三步认证
1. **读凭证**：读取 `assets/authorization.txt`。文件不存在、为空或仍是占位值时，输出下面的「申请提示」并停止本轮，等用户把 Access Secret 发过来后写入该文件，再执行第 2 步。
2. **验证凭证**：执行 `python3 scripts/shihuo_api.py verify`。返回 `{"ok": true, ...}` 即通过，进入第 3 步；返回 `code` 为 `missing_secret`、`invalid_secret`、`secret_rejected` 时，输出「申请提示」并停止本轮，等用户发来新的 Access Secret，覆盖写入 `assets/authorization.txt`，然后重新执行第 2 步。
3. **处理业务**：验证通过后按本文档后续章节判定场景并处理用户的购物请求。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### 三步认证
1. **读凭证**：读取 `assets/authorization.txt`。文件不存在、为空或仍是占位值时，输出下面的「申请提示」并停止本轮，等用户把 Access Secret 发过来后写入该文件，再执行第 2 步。
2. **验证凭证**：执行 `python3 scripts/shihuo_api.py verify`。返回 `{"ok": true, ...}` 即通过，进入第 3 步；返回 `code` 为 `missing_secret`、`invalid_secret`、`secret_rejected` 时，输出「申请提示」并停止本轮，等用户发来新的 Access Secret，覆盖写入 `assets/authorization.txt`，然后重新执行第 2 步。
3. **处理业务**：验证通过后按本文档后续章节判定场景并处理用户的购物请求。
用户在同一轮消息里同时给出购物需求和 Access Secret 时，先写入文件并验证，通过后直接继续处理该需求，不要求用户重发。
The skill explicitly permits a credential and shopping request in the same message, then continues processing without requiring a sanitized request. Combined with the instruction to forward complete original messages to link tools, this creates a concrete path for an Access Secret to enter external business payloads.
2. **验证凭证**：执行 `python3 scripts/shihuo_api.py verify`。返回 `{"ok": true, ...}` 即通过，进入第 3 步；返回 `code` 为 `missing_secret`、`invalid_secret`、`secret_rejected` 时，输出「申请提示」并停止本轮，等用户发来新的 Access Secret，覆盖写入 `assets/authorization.txt`，然后重新执行第 2 步。
3. **处理业务**：验证通过后按本文档后续章节判定场景并处理用户的购物请求。
用户在同一轮消息里同时给出购物需求和 Access Secret 时，先写入文件并验证，通过后直接继续处理该需求，不要求用户重发。
### 申请提示
The mandated prompt asks the user to copy an Access Secret directly into the conversation. Authentication is appropriate for this service, but collecting a reusable secret through ordinary chat can expose it to transcript retention and systems with conversation access.
### 申请提示
需要用户提供 Access Secret 时，本轮只输出下面这段原文，逐字照抄：
> Access Secret 验证失败，暂时无法调用识货数据。请先去 [识货开放平台](https://www.shihuo.cn/page/openPlatform) 申请Access Secret 并复制给我，我会帮你配置好识货mcp获取数据的能力
This prompt explicitly solicits a service secret in chat instead of using a protected credential-entry mechanism. It is the same provisioning weakness as the finding at line 56, not evidence of a separate malicious harvesting operation.
需要用户提供 Access Secret 时，本轮只输出下面这段原文，逐字照抄：
> Access Secret 验证失败，暂时无法调用识货数据。请先去 [识货开放平台](https://www.shihuo.cn/page/openPlatform) 申请Access Secret 并复制给我，我会帮你配置好识货mcp获取数据的能力
约束：
The matched prompt requests a reusable Access Secret through the conversation, creating avoidable credential-retention exposure. This is a duplicate of the other findings on the same prompt and should not be counted as an additional independent vulnerability.
需要用户提供 Access Secret 时，本轮只输出下面这段原文，逐字照抄：
> Access Secret 验证失败，暂时无法调用识货数据。请先去 [识货开放平台](https://www.shihuo.cn/page/openPlatform) 申请Access Secret 并复制给我，我会帮你配置好识货mcp获取数据的能力
约束：
The instruction persists the raw credential in a predictable plaintext file without requiring access permissions, protected storage, or cleanup. Avoiding secret echoes and command-line arguments is helpful but does not protect this file from other workspace readers or accidental inclusion in backups and artifacts.
### 凭证写入与保密
- 写入 `assets/authorization.txt` 时只写 Access Secret 本身，单行、无引号、无 `Bearer ` 前缀，整文件覆盖写入；已有有效 Secret 时不用占位值覆盖，除非用户要求更换。
- 不在回复、日志、报告、Skill 文件、项目文件、记忆文件或生成文档中复述完整 Secret；不通过命令行参数传递 Secret，避免进入 Shell 历史和进程列表。脚本只从文件读取，没有传 Secret 的命令行参数。
- 验证脚本返回 `request_failed`、`rpc_error`、`api_key_rejected` 或 `no_tools` 时，是服务端或网络问题，不是用户凭证问题：说明暂时取不到识货数据，不要求用户重新申请 Access Secret。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- 写入 `assets/authorization.txt` 时只写 Access Secret 本身，单行、无引号、无 `Bearer ` 前缀，整文件覆盖写入；已有有效 Secret 时不用占位值覆盖，除非用户要求更换。
- 不在回复、日志、报告、Skill 文件、项目文件、记忆文件或生成文档中复述完整 Secret；不通过命令行参数传递 Secret，避免进入 Shell 历史和进程列表。脚本只从文件读取，没有传 Secret 的命令行参数。
- 验证脚本返回 `request_failed`、`rpc_error`、`api_key_rejected` 或 `no_tools` 时，是服务端或网络问题，不是用户凭证问题：说明暂时取不到识货数据，不要求用户重新申请 Access Secret。
### 调用识货工具
The directory description confirms that the runtime Access Secret is kept as plaintext inside the skill's assets directory. Stating that it is not submitted with the package reduces intended distribution risk but does not establish enforceable exclusions or filesystem protections; this duplicates the storage weakness rather than indicating a separate attack.
| `-- qwen.yaml # 千问平台适配配置
|-- assets/ # 随技能包分发的静态资源
| |-- tools.json # Skill 使用的工具 Schema 镜像，字段定义仍以服务端为准
| `-- authorization.txt # Access Secret，单行明文，运行时写入，不随包提交
|-- references/ # 运行时按需加载的规则、流程、模板和工具契约
| |-- scenarios/ # 按主场景组织的 README、workflow 和 output
| `-- tools/ # 各工具的入参、前置条件、响应字段和调用约束
The workflow explicitly sends the entire original message to external link-processing tools rather than extracting only necessary shopping data. Because it also accepts an Access Secret alongside a shopping request, this can disclose the credential or unrelated personal information as business-request content; the prohibition on repeating secrets in replies and logs does not explicitly prevent this transmission.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
display_name: "识货购物助手"
short_description: "按需求推荐商品，或按关键词、图片、第三方商品链接查询识货全网渠道价格、隐藏优惠和历史价格。"
default_prompt: >-
先读取 SKILL.md，按「识货开放平台与前置认证流程」完成 Access Secret 读取与验证，所有识货工具都通过 scripts/shihuo_api.py 调用；验证未通过前只输出申请提示，不调用业务工具。
本 Skill 处理四个场景：带链接或口令且要找券、补贴的走 link-coupon；带链接或口令问价格、渠道、怎么买更合适的走 link-price-comparison；无链接且没有唯一目标商品的走 recommendation；无链接的其余情况走 price-comparison。先读取所选场景的 workflow.md 和 output.md，读取完成前不得调用商品业务工具。
recommendation 未给品类但已给用途、对象、场景、预算、风格或品牌等消费线索时，自行推断 1 至 3 个商品关键词并逐个搜索，不因品类缺失追问；入口最多保留 4 个真实 goods 候选，按需求条件分层并为主推商品按场景规则自动选择一个参考 SKU，在可用时查询该规格渠道报价，不因规格未指定追问。
price-comparison 入口最多解析 3 个真实 goods 候选，先按用户条件选出 1 个主商品；配色、尺码、容量或版本未明确时按 workflow 的排序规则自动选主款式和主 SKU，其他候选只作切换参考、不参与最低价。链接入口把用户原文整体交给 link_parse 和 goods_link_query，以链接对应的规格为唯一比较基准。
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python3 scripts/shihuo_api.py call --args '<json 入参对象>'
脚本输出 `{"ok": true, "result": {...}}` 时，`result` 就是下文描述的结果壳；入参含链接或引号时改用 `--args-file`。输出 `{"ok": false, "code": ...}` 表示调用未完成：`missing_secret`、`invalid_secret`、`secret_rejected` 回到认证流程，其余按服务端或网络问题说明，不要求用户重新申请 Access Secret。
## 通用响应约定
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
成功 {"ok": true, "result": { 工具结果壳 }}
失败 {"ok": false, "code": "<错误码>", "message": "<说明>"}
退出码：0 成功，1 用法错误，2 缺少 Access Secret，3 Access Secret 被拒绝，4 请求失败。
"""
from __future__ import annotations