Security audit

Salesmartly Api

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-related SaleSmartly automation, but it ships exposed credentials and grants broad, under-scoped authority over customer data, business actions, local commands, and external notifications.

Review before installing. Rotate and remove the packaged API key, delete any local agent permission file such as .claude/settings.local.json, restrict API and webhook destinations to approved SaleSmartly and DingTalk hosts, and require explicit confirmation for sends, imports, assignments, session endings, device changes, scheduled jobs, and any third-party posting. Treat generated scripts as untrusted until manually reviewed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: api-key.json:1
Finding: Committed SaleSmartly API Credentials
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/generate-query-script.py:98
Finding: Remote API Documentation Is Interpolated into Executable Python Source
Content: View full analysis
dict: """获取 API 文档内容""" url = f"{APIFOX_BASE}/{api_id}.md" ssl_context = ssl.create_default_context() ssl_context.check_hostname = True ssl_context.verify_mode = ssl.CERT_REQUIRED try: req = urllib.request.Request(url, headers={"User-Agent": "SaleSmartly-Agent/1.0"}) with urllib.request.urlopen(req, timeout=30, context=ssl_context) as response: content = response.read().decode('utf-8') return parse_api_doc(content) ``` Remote names and descriptions are inserted directly into Python syntax: ```python for param in api_info['params']: if param['in'] == 'query' and param['name'] not in ['project_id', 'page', 'page_size', 'external-sign']: param_args += f" parser.add_argument('--{param['name'].replace('_', '-')}', type=str, default=None, help='{param['description']}')\n" param_doc += f" {param['name']}: {param['description']}\n" script = f'''#!/usr/bin/env python3 """ SaleSmartly {name} 脚本自动生成 - 根据 API 文档 API 路径：{api_info['path']} """ ``` The resulting source is written and marked executable: ```python output_path.write_text(script, encoding='utf-8') print(f"\n✅ 脚本已生成：{output_path}") print(f" 大小：{len(script)} bytes") import os os.chmod(output_path, 0o755) ``` ### Technical Analysis TLS verification protects transport integrity but does not make the remote document safe as source code. Values derived from the first line and parameter descriptions are embedded into triple-quoted strings, function-related source, and single-quoted `argparse` arguments without safe quoting or AST construction. A malicious description containing a quote, newline, and Python ...[truncated 1792 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/config.py:66
Finding: Configurable Base URL Can Redirect Signed Business Requests to an Untrusted Host
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/get-customer-history.py:158
Finding: Customer PII and Message Content Can Be Posted to Arbitrary Webhook Destinations
Content: View full analysis
dict: """发送 JSON POST 到外部 webhook（如钉钉）""" data = json.dumps(payload, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, method="POST", headers={"Content-Type": "application/json"}, ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The declared feature is DingTalk notification, but the code accepts an arbitrary URL from configuration or `SALESMARTLY_DINGTALK_WEBHOOK`. There is no hostname allowlist, HTTPS requirement, private-address rejection, redirect restriction, data minimization, or warning showing the effective recipient before transmission. Although `get_customer_history.py` only sends when its `--dingtalk` behavior is requested, the consent applies to “DingTalk,” not necessarily to an arbitrary third-party host silently substituted thro ...[truncated 1357 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: .claude/settings.local.json:3
Finding: Project-Level Agent Configuration Grants Excessive Command and Business-API Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (119)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The negative-feedback alert example forwards customer identifiers, conversation references, timestamps, and message content to DingTalk with no privacy warning or minimization guidance. This is particularly risky because it exports potentially sensitive customer communications to a third-party messaging service in real time.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The FAQ states that no data is uploaded to external servers except SaleSmartly, yet the same file describes DingTalk delivery and GitHub Issue submission. This contradictory security statement can cause users to make unsafe decisions based on false assurances, undermining informed consent and risk assessment.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码块的实际作用是一个 quickstart 示例脚本：检查本地配置文件与依赖、展示使用说明、列出可用脚本。它没有展示任何对 SaleSmartly API 的真实请求逻辑，也没有实现描述中声称的核心业务操作。虽然输出中提到其他脚本名称，暗示仓库可能包含相关功能，但就当前提供的代码块本身而言，其主要目的与声明的“全功能 API 技能”明显不一致。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 该代码块的主要目的与声明存在明显偏差。声明描述的是一个可执行多类 SaleSmartly API 业务操作的“全功能 API 技能”；而代码实际实现的是一个 intent_router.py，用于把自然语言请求映射到预定义脚本名称，并提取非常有限的参数（如 days、tags、chat_user_id）。它没有网络请求、没有 API 客户端、没有调用这些脚本、没有客户/会话/营销/WhatsApp 的实际增删改查逻辑，因此不能视为所声明的完整技能实现。虽然代码中的意图列表与声明的触发词和业务范围高度相关，但这是“路由层/辅助层”而不是“全功能 API 技能”本体。因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向终端业务能力的 SaleSmartly API 技能集合，强调已有 29 个核心脚本可用于客户、销售、消息、会话、WhatsApp 等操作，并配有大量业务触发词。实际代码却是仓库内部的辅助开发工具，用于从远程文档自动生成脚本模板。它访问的主要资源是 Apifox 文档站点和本地文件系统，核心行为是代码生成，而不是按声明执行具体的客户管理、消息发送、会话分配或统计查询功能。因此其主要目的与行为和描述不一致，属于明显的 description-behavior mismatch。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose presents an end-user operational skill for managing SaleSmartly customers, sessions, messaging, sales, and WhatsApp devices across many scripts. However, the provided code chunk is specifically an internal utility named 'check-api-updates.py' that retrieves a documentation index from Apifox, parses API identifiers, checks local script existence, and reports implemented versus missing scripts. Its network access is to the documentation host, not to execute the claimed customer/chat/WhatsApp business actions. This is not merely a supporting detail; it is a materially different primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向终端业务使用的 SaleSmartly API 综合技能，覆盖客户、销售、会话、消息、WhatsApp 等具体操作；而该代码块的主要职责是根据 API 文档自动生成查询脚本，属于开发/构建辅助工具。虽然它与 SaleSmartly API 生态相关，但其直接行为与声明中的用户可触发业务能力明显不一致。代码访问的资源也主要是 API 文档地址而非声明暗示的业务数据接口，并且会在本地输出新脚本文件，这属于未在描述中体现的能力。因此应判定为描述与实际行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code does interact with SaleSmartly and fits loosely under 'marketing', but the declared description and triggers focus on customer management, sessions, messaging, sales, chat history, assignment, feedback, and WhatsApp/device/member statistics. This specific script's primary function is querying 分流链接 (routing/distribution links) via a marketing endpoint, which is not clearly disclosed by the description or reflected in the trigger list. The mismatch is not about malicious or extra-sensitive behavior; it is about the supplied chunk having a more specific and different operational focus than the declared capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 描述强调的是面向最终用户的 SaleSmartly 全功能 API 技能，核心能力应是客户/销售/消息/会话/WhatsApp 等管理操作；而代码片段是 tests/test-intent-recognition.py，一个开发/测试用途的脚本。其主要功能是验证不同模型下的意图识别准确率：构造 prompt、调用 LLM、解析 JSON、对测试结果打分并输出报告。虽然测试用例中提到了 query-customers.py、assign-session.py、query-whatsapp-apps.py 等脚本名，但该代码并未实际调用这些业务脚本或相关业务 API。故其主用途与声明的技能能力存在实质性不一致，属于描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents an end-user operational SaleSmartly skill with broad business functions across customers, chats, sales, follow-up, assignment, and WhatsApp management. However, the supplied code does not implement those business operations. It is a testing script focused on validating an intent router's classification accuracy using predefined utterances mapped to expected intents. While the test cases reference the same domain and triggers, the actual behavior is evaluation/reporting infrastructure, not the claimed full-featured API skill itself. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · intent_router.py (reported line 275)May include surrounding context.
python
rules = {} for intent_name, intent_data in self.intent_map.items(): rules[intent_name] = intent_data["keywords"] return rules def _parse_skill_triggers(self, skill_md_path: str) -> Dict[str, List[str]]: """

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/README.md (reported line 42)May include surrounding context.
md
`--id`, `--tags` | `--id 123 --tags VIP` | | [batch-tags.py](#batch-tagspy) | 批量打标签 | `--customer-ids`, `--tags` | `--customer-ids 1,2,3 --tags VIP` | | [import-orders.py](#import-orderspy) | 导入订单 | `--file` | `--file orders.csv` | ### 🔵 WhatsApp 管理 | 脚本 | 功能 | 常用参数 | 示例 | |------|------|---------|------| | [query-whatsapp-apps.py](#query-whatsapp-appspy) | 设备列表 | 无 | - | | [add-whatsapp-device.py](#add-whatsapp-devicepy) | 添加设备 | `--name` | `--name 客服 1` | | [delete-whatsapp-device.py](#delete-whatsapp-devicepy) | 删除设备 | `--app-id` | `--app-id 123` | | [get-whatsapp-qrcode.py](#get-whatsapp-qrcodepy) | 获取二维码 | `--app-id` | `--app-id 123` | | [set-whatsapp-proxy.py](#set-whatsapp-proxypy) | 设置代理 | `--app-id`, `--proxy` | `--app-id 123 --proxy http://proxy.com` | ### 🟣 反馈与报告 | 脚本 | 功能 | 常用参数 | 示例 | |------|------|---------|------| | [daily-feedback-report.py

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document advertises capabilities such as DingTalk push/report delivery that are outside the stated SaleSmartly API skill scope, which can mislead users about what the skill may do with data. Scope expansion in documentation is dangerous because operators may authorize or rely on external transmissions and automations they did not expect from the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide promotes automated DingTalk pushes of business reports without a clear warning that business data will be transmitted to an external platform. Users may unknowingly expose operational metrics, customer-related summaries, or internal performance data outside the primary system.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Claiming Excel import capability beyond the declared scope creates a trust and control problem because users may provide bulk customer data to a skill that has not clearly disclosed such ingestion behavior. Bulk import features materially increase the amount of sensitive data exposed and should not be implied unless formally declared and documented.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Promising automatic GitHub Issue creation from chat feedback extends the skill from internal CRM/API operations into external third-party publication. This is dangerous because feedback may contain customer data, internal business details, or incident context that could be transmitted to GitHub without explicit, informed approval.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Describing AI-created scheduled tasks exceeds the declared API-skill scope and introduces unattended execution risk. Scheduled jobs can repeatedly send reports or query data without fresh user review, increasing the chance of ongoing unauthorized disclosure or operational misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Unattended scheduled report pushes increase the risk of repeated external disclosure because outbound messaging can continue without per-send review. Without a warning or approval controls, users may enable persistent data transfers they do not fully understand or later forget about.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is entirely written in Chinese and uses imperative language throughout, but it does not state that the skill is region-specific or provide any user opt-in for language/locale preference. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The README advertises operations that can modify or delete business data and infrastructure state, such as creating/updating customers, batch tagging, importing orders, assigning/ending sessions, and deleting WhatsApp devices, without emphasizing confirmation requirements or operator safeguards. In an agent skill context, vague natural-language triggers combined with destructive actions increase the chance of unintended execution, privilege misuse, or costly operational mistakes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README makes a strong security claim that there is 'no dynamic code generation or download,' yet elsewhere it documents AI-driven installation via cloning and includes tooling such as generate-query-script.py and batch-generate-scripts.py. This inconsistency can mislead users and reviewers about the actual trust boundary, causing them to approve or run a skill with more code-generation and supply-chain risk than advertised.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation describes execution of local scripts that inherently require shell, file, environment, and network access, but it does not declare any explicit tool scope or permissions. This creates an over-privileged and ambiguous execution model where an agent may invoke powerful capabilities without clear boundaries or review, increasing the chance of unsafe operations against customer data and external APIs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday terms like '客户', '销售', '分配', and '反馈', which can cause the skill to activate on loosely related conversations. In a skill that can query data, assign sessions, end sessions, or manage devices, accidental activation raises the risk of privacy exposure and unintended state-changing actions.
Content: No source excerpt is available for this finding.