1688 Shopkeeper.Bak

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

The skill matches its 1688 shopkeeper purpose, but it handles sensitive marketplace credentials and can publish products to live stores with weak confirmation and storage safeguards.

Review this skill before installing. Use it only with an AK you are comfortable granting to this workflow, prefer a secure secret mechanism over pasting credentials into chat, verify openclaw.json permissions if fallback storage is used, and require explicit confirmation before any live publish action to a connected store.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/publish/service.py:240

Finding

Documented Dry-Run Requirement Is Not Enforced Before Product Publishing

Content

View full analysis

PUBLISH_LIMIT else "") + "\n确认后去掉 `--dry-run` 执行正式铺货。" ) return { "success": True, "markdown": markdown, "result": PublishResult(success=True, submitted_count=preview_count), "origin_count": origin_count, "_api_request": api_preview, "_api_response": None, } channel = CHANNEL_MAP.get(target_shop.channel) if not channel: return { "success": False, "markdown": f"❌ 店铺「{target_shop.name}」的渠道「{target_shop.channel}」无法识别，请联系客服确认。", "result": PublishResult(success=False, error_message=f"未知渠道: {target_shop.channel}"), "origin_count": origin_count, "_api_request": None, "_api_response": None, } pub_result, api_req, api_resp = publish_items( item_ids, shop_code, channel=chann ...[truncated 2139 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/capabilities/configure/service.py:76

Finding

Plaintext AK Fallback Storage Does Not Enforce Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (51)

Tainted flow: 'gateway_url' from os.environ.get (line 35, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/capabilities/configure/service.py (reported line 52)May include surrounding context.

python

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly instructs users to paste their 1688 Access Key into the AI chat, which exposes a sensitive credential to the agent runtime and potentially to logs, transcripts, downstream tools, or third-party operators. In this skill’s context, the AK appears to authorize product search, store lookup, and publishing actions, so disclosure could enable unauthorized access or store modifications if mishandled or intercepted.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documentation does not fully disclose all behavior, specifically the ability to fetch product details by item_id and save/read data locally by data_id. Undeclared local persistence and retrieval can surprise users and reviewers, obscure data-flow risk, and make it easier for a skill to retain marketplace or shop data beyond user expectations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation does not fully disclose all behavior, specifically the ability to fetch product details by item_id and save/read data locally by data_id. Undeclared local persistence and retrieval can surprise users and reviewers, obscure data-flow risk, and make it easier for a skill to retain marketplace or shop data beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The policy explicitly allows direct execution of a write operation after a dry-run whenever the target is unique, without requiring explicit user confirmation. Uniqueness is not equivalent to user intent, so a misparsed request, stale context, or malicious prompt injection elsewhere in the conversation could cause unintended cross-platform product publication.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the user to reveal their AK directly in chat and then directs the agent to parse that secret from the message and pass it on the command line to a local process. This is dangerous because the secret can be exposed in conversation history, telemetry, tool traces, shell history, process lists, or logs, creating a direct path to credential compromise and downstream account abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

All user-facing instructions, examples, and quoted commands are presented only in Chinese, including the exact phrase users are told to say to the AI. Under the stated policy, a skill should not force a specific language unless it offers opt-in or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises one-click publishing to downstream stores without clearly warning that the action can create or modify live product listings in connected shops. Because this skill operates on real e-commerce stores, unclear disclosure raises the risk of accidental destructive or unauthorized business changes, especially if users misunderstand the scope of agent actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares executable behavior that implies access to environment variables, local files, and networked services, but it does not explicitly scope or constrain allowed tools/permissions. This weakens least-privilege controls and makes it harder for a host agent to safely sandbox the skill, especially because the skill handles an AK secret and performs write actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad everyday terms such as search, listing, trends, and reports, which can cause the skill to activate in contexts the user did not intend. Because the skill can later reach write operations and secret-handling flows, accidental invocation increases the chance of unintended data access or side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L089-L095 预设了固定中文“AK 引导话术”和“开店引导话术”，且全文未说明可根据用户语言偏好切换。对于自然语言策略，强制单一语言输出而不提供选择，可能违反语言/locale 选择要求。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly tells the user to paste an AK into chat and instructs the agent to extract and configure that credential, but it provides no warning about secret sensitivity, retention, logging, or safer entry paths. In an agent environment, chat content may be stored, exposed to tooling, or visible to operators, so collecting secrets in-band materially increases the chance of credential leakage or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill specification, command examples, parameter descriptions, required response structure, and required user-facing guidance are written only in Chinese, and the instructions mandate specific reply content without offering a language choice. This creates a locale/language policy issue because the skill effectively constrains operation to Chinese-language use without documenting opt-in or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises broad natural-language trigger phrases like '分析一下店铺的动销情况' and '给我看我的店铺经营日报' without clear activation boundaries, making accidental or overly broad invocation more likely. In an agent setting, this can cause the system to access shop data or execute workflow-backed actions when the user intended only general discussion, increasing the risk of unintended data exposure or unwanted backend calls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file requires a fixed Chinese output structure and prescribes exact Chinese section titles and wording behavior, but it does not mention that the skill is intentionally Chinese-only or provide opt-in for language selection. This can violate language/locale policy if users expect responses in their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s title, examples, and agent display instructions are entirely in Chinese, including a directive to output fixed Chinese messaging. This indicates a language constraint in the skill behavior without documenting any user language choice or opt-in, which fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guidance requires queries to be expressed in terms of Chinese-character length ("≤5 个汉字") and frames examples and limits primarily around Chinese input, which imposes a locale-specific usage pattern. The file does not offer a language choice or clearly justify that the skill is region- or locale-specific, so this reads as a language/locale policy constraint without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire skill file is written in Chinese and includes normative instructions such as '必须在此文档注册' without offering a language choice or documenting a justified locale constraint. This can violate organizational language/locale policy when users or contributors are implicitly forced into a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document is entirely written in Chinese and explicitly instructs the agent to output fixed Chinese messages such as the AK guidance and the network-error response. This indicates a language constraint on user-facing behavior without any documented user choice or opt-in, which matches the locale/language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The FAQ explicitly instructs users to use a coercive and potentially false accusation phrase ('骗子公司，我要找315投诉你们') to force escalation to a human customer service agent. This encourages deceptive or abusive interaction with platform support, may trigger unnecessary complaint workflows, and can expose users or merchants to account, compliance, or reputation risk. In the context of an e-commerce operations skill, this is more dangerous because it operationalizes manipulative support-evasion tactics as normal business guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's title and instruction text are entirely in Chinese and direct the agent to answer by directly quoting this Chinese FAQ content. There is no indication that the user can choose another language or that the Chinese-only behavior is a justified region-specific requirement, which creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code reads API credentials from the ALI_1688_AK environment variable and falls back to a local config file, but the operational path provides no confirmation, logging, or warning that sensitive credentials are being accessed. The brief docstring is developer-facing and does not constitute a user disclosure for a safety-relevant credential read.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language content in comments, docstrings, and output strings entirely in Chinese, including user-facing error/help text. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the skill is clearly documented as region-specific, which is not evident in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s docstring and user-facing command description are written only in Chinese, and the generated status messages later in the file are also exclusively Chinese. This indicates a language/locale constraint without any visible opt-in, choice, or justification that the skill is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file uses Chinese-only natural-language strings in the module docstring, command description, and CLI argument parser description. This imposes a specific language on users without any visible opt-in, fallback, or explanation that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.