PDD Restock Check

• Outcome: Pass
• Latest audit: Oct 10, 2026 · 1:45 PM UTC
• Version: 1.1.0

Overview

This skill is a coherent Pinduoduo inventory restock checker, with disclosed local state and optional ClickHouse backend use, but users should review where business data is stored or queried.

Install only if you are comfortable with the skill reading locally synced Pinduoduo shop inventory and creating files under ~/.pdd-data by default. If you set PDD_CH_URL, use a trusted preferably HTTPS ClickHouse endpoint because shop inventory and sales metrics may be handled there. Avoid pointing PDD_DB_PATH or PDD_RESTOCK_POLICY at sensitive or shared system paths.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/store.py (reported line 151)May include surrounding context.

python

def _ch(sql, data=None):
    q = urllib.parse.urlencode({"query": sql, "default_format": "JSONEachRow"})
    req = urllib.request.Request(f"{CH_URL}/?{q}", data=data, method="POST" if data else "GET")
    return urllib.request.urlopen(req, timeout=30).read().decode()

def _ch_rows(sql):
    out = _ch(sql).strip()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises executable behavior that can read environment variables, write local files, and send data over the network, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization and review gap: an agent may invoke a skill with broader capabilities than the user expects, including writing a persistent policy file or transmitting inventory data to a remote ClickHouse endpoint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill when the user 'asks what to restock or wants an inventory check,' which is a natural-language trigger framed very broadly rather than as a constrained command or narrowly scoped activation rule. It lacks negative examples or explicit boundaries, so the skill could be invoked on common inventory-related conversation beyond the intended context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation says first run will automatically generate a local restock policy file and allows switching to ClickHouse via an environment variable, but it does not clearly warn that this creates or modifies persistent local state and may send inventory data to a remote service. In a commerce context, inventory and sales data can be commercially sensitive, so silent persistence and outbound transmission increase privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'POLICY_PATH' from os.environ.get (line 23, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 95% confidence

Finding

The path used for the policy file is derived from the environment variable PDD_RESTOCK_POLICY and is written to without validation. If an attacker can influence the process environment, they can redirect this write to an arbitrary filesystem location writable by the process, causing unintended file creation or overwrite and violating the skill's read-only expectations.

Content

Scanner excerpt · scripts/check_restock.py (reported line 45)May include surrounding context.

python

return dict(DEFAULT_POLICY), False
    try:
        os.makedirs(os.path.dirname(POLICY_PATH), exist_ok=True)
        with open(POLICY_PATH, "w", encoding="utf-8") as f:
            json.dump(DEFAULT_POLICY, f, ensure_ascii=False, indent=1)
    except OSError:
        pass  # 沙箱只读也不阻塞巡检

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s descriptive text and user-facing status strings are written exclusively in Chinese, including operational guidance and upgrade recommendations. This imposes a specific language/locale without any opt-in or indication that the skill is region-specific, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

ClickHouse mode sends inventory and shop data to a remote endpoint using whatever URL is in PDD_CH_URL, and the example explicitly shows plain HTTP. In this skill context, the transmitted data includes shop inventory, pricing, sales, and operational metrics, so using insecure transport or silently sending to a remote backend can expose commercially sensitive data to interception or unauthorized collection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This shared storage layer persists shop trade metrics and product edit-event history that go beyond the stated restock-check purpose. In an agent skill context, collecting and retaining broader business telemetry than needed increases privacy and data-minimization risk, especially if users invoke a seemingly narrow inventory function without realizing additional operational data may be stored.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level documentation states the tool is 'pure read-only', yet the code writes configuration state to disk during initialization. This is a security-relevant integrity issue because operators may grant the skill broader trust or permissions based on inaccurate behavior claims.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises itself as read-only inventory inspection, but on first run it creates a local configuration file. While not directly a severe exploit by itself, this mismatch weakens trust assumptions and can matter in sandboxed or least-privilege environments where users or orchestrators expect zero writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

In SQLite mode, _sq() creates directories and opens a database at ~/.pdd-data/pdd.db, which results in persistent local file creation and modification. The code contains implementation comments about journal behavior, but no user-facing disclosure or explicit warning that running the skill will write data to the local filesystem.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.