PDD Shop Sync

• Outcome: Review
• Latest audit: Oct 10, 2026 · 1:46 PM UTC
• Version: 1.5.0

Overview

The skill matches its stated Pinduoduo shop-sync purpose, but it handles logged-in browser sessions, persistent profiles, cookie state, automatic host setup, and default diagnostic reporting in ways users should review before installing.

Install only if you are comfortable letting the skill control a dedicated Chrome or Edge profile for Pinduoduo, read login-session state through CDP, persist shop data under ~/.pdd-data, and optionally send drift diagnostics to Claw School. For business or regulated environments, disable PDD_BUG_REPORT if outbound diagnostics are not approved, avoid untrusted PDD_BUG_REPORT_URL or PDD_CH_URL values, and require explicit approval before any Python installation or browser-profile creation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (34)

Tainted flow: 'req' from os.environ.get (line 281, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code sends diagnostic data to a remote endpoint whose URL is controlled by the PDD_BUG_REPORT_URL environment variable, allowing outbound transmission to an arbitrary host. Although the payload is intended to be minimal, this creates an exfiltration channel and expands behavior beyond local sync; in this shop-data context, unexpected outbound reporting is especially sensitive because it occurs in software handling merchant account data and operational metadata.

Content

Scanner excerpt · scripts/resilience.py (reported line 284)May include surrounding context.

python

req = urllib.request.Request(
            REPORT_URL, data=payload, method="POST",
            headers={"Content-Type": "application/json"})
        with urllib.request.urlopen(req, timeout=3) as r:
            resp = json.loads(r.read().decode() or "{}")

        s = _load()

Tainted flow: 'req' from os.environ.get (line 150, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/store.py (reported line 151)May include surrounding context.

python

def _ch(sql, data=None):
    q = urllib.parse.urlencode({"query": sql, "default_format": "JSONEachRow"})
    req = urllib.request.Request(f"{CH_URL}/?{q}", data=data, method="POST" if data else "GET")
    return urllib.request.urlopen(req, timeout=30).read().decode()

def _ch_rows(sql):
    out = _ch(sql).strip()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a data sync utility, but it also launches and manages local Chrome/Edge processes with remote debugging enabled, maintains persistent profiles, inspects pages/cookies, and registers shops in local files. Those are powerful host-control and session-management capabilities that increase attack surface beyond ordinary data synchronization and can affect a user's broader browser environment if not tightly isolated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a data sync utility, but it also launches and manages local Chrome/Edge processes with remote debugging enabled, maintains persistent profiles, inspects pages/cookies, and registers shops in local files. Those are powerful host-control and session-management capabilities that increase attack surface beyond ordinary data synchronization and can affect a user's broader browser environment if not tightly isolated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a data sync utility, but it also launches and manages local Chrome/Edge processes with remote debugging enabled, maintains persistent profiles, inspects pages/cookies, and registers shops in local files. Those are powerful host-control and session-management capabilities that increase attack surface beyond ordinary data synchronization and can affect a user's broader browser environment if not tightly isolated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest is written entirely in Chinese and explicitly describes itself as a security assessment statement for the receiving agent, but it does not offer any language choice, localization fallback, or justification for restricting comprehension to Chinese readers. This is a natural-language locale policy concern because the file effectively imposes a single language without opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope even though it requires shell execution, environment access, file writes, and network operations. That mismatch weakens policy enforcement and informed consent, making it easier for an agent to invoke broad capabilities such as browser control, local persistence, and outbound network access without clear guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase “或说'同步一下拼多多'随时触发” presents a natural-language invocation that is broad and conversational rather than a narrowly scoped command. Because the file does not provide explicit trigger constraints or negative examples, this could cause unintended invocation when a user casually mentions syncing Pinduoduo.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation directs the agent to install Python via package manager or download a runtime from the internet, which extends the skill from data sync into software installation and code acquisition. That broadens supply-chain risk, persistence on the host, and the chance of unintended system modification well beyond what a user would expect from a shop-sync skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims data stays in local SQLite or enterprise ClickHouse, but it also performs automatic bug-report submissions to a third-party endpoint. Even if the report is described as sanitized, undisclosed outbound telemetry violates least surprise and creates data-governance and privacy risk, especially in enterprise merchant environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring and comments present the skill's descriptive instructions exclusively in Chinese. Under the language/locale policy rule, forcing a single language without offering user choice or documenting a justified locale constraint is a policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script uses Chrome DevTools Protocol to access httpOnly cookie metadata for PASS_ID, which exceeds ordinary page-level access and leverages browser-debugging privileges. Even though it only reads expiry metadata rather than the cookie value, this is sensitive authentication-state information and is broader access than the skill description clearly discloses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code inspects httpOnly login cookie metadata through CDP without any clear user-facing disclosure in the script's behavior. Access to authentication-related browser state is privileged and unexpected in a data-sync tool, so the lack of transparent notice increases the risk of covert collection or misuse.

Content

No source excerpt is available for this finding.

Tainted flow: 'SHOPS_FILE' from os.environ.get (line 36, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 82% confidence

Finding

The registry file path is derived from PDD_DATA_DIR and then opened for writing without constraining it to a safe base directory. An attacker who can set the environment could redirect writes to arbitrary filesystem locations, potentially overwriting sensitive files accessible to the process.

Content

Scanner excerpt · scripts/chrome_manager.py (reported line 96)May include surrounding context.

python

"""就地截断写（非 原子替换）：os.replace 的 unlink 步骤会被 Agent 沙箱判成
    "删除文件"弹权限。fsync 把就地写的损坏窗口压到最小。"""
    os.makedirs(DATA_DIR, exist_ok=True)
    with open(SHOPS_FILE, "w", encoding="utf-8") as f:
        f.write(_dump_yaml({"shops": shops}))
        f.flush()
        os.fsync(f.fileno())

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · scripts/chrome_manager.py (reported line 146)May include surrounding context.

python

def probe(port):
    """端口上有活着的 CDP 吗？活着返回 /json 列表，否则 None。（纯标准库）"""
    try:
        with urllib.request.urlopen(f"http://localhost:{port}/json", timeout=PROBE_TIMEOUT) as r:
            return json.loads(r.read().decode())
    except Exception:
        return None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/chrome_manager.py (reported line 183)May include surrounding context.

python

kw["creationflags"] = 0x00000008 | 0x00000200  # DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP
    else:
        kw["start_new_session"] = True
    subprocess.Popen(cmd, **kw)
    for _ in range(30):  # 等最多 15s 起 CDP
        time.sleep(0.5)
        if probe(port):

Tainted flow: 'cmd' from os.environ.get (line 172, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The executable path can be sourced from the PDD_CHROME_PATH environment variable with only an existence check before being passed to subprocess.Popen. If an attacker can influence the environment in which this skill runs, they can cause arbitrary local program execution under the agent’s privileges instead of launching Chrome.

Content

Scanner excerpt · scripts/chrome_manager.py (reported line 183)May include surrounding context.

python

kw["creationflags"] = 0x00000008 | 0x00000200  # DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP
    else:
        kw["start_new_session"] = True
    subprocess.Popen(cmd, **kw)
    for _ in range(30):  # 等最多 15s 起 CDP
        time.sleep(0.5)
        if probe(port):

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code actively retrieves authenticated Pinduoduo cookies, including the PASS_ID httpOnly session cookie, through the Chrome DevTools Protocol. That grants access to credentials broader than simple page automation and could enable account/session hijacking if the value is exposed, logged, reused elsewhere, or if this component is repurposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

At the point where authenticated browser cookies are accessed, the code does not provide a clear user-facing warning or consent flow. Because this operation touches live session credentials, lack of transparency increases the risk of unauthorized credential access and weakens user trust and oversight.

Content

No source excerpt is available for this finding.

Tainted flow: 'HEALTH' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/resilience.py (reported line 90)May include surrounding context.

python

"""
    try:
        os.makedirs(os.path.dirname(HEALTH), exist_ok=True)
        with open(HEALTH, "w") as f:
            json.dump(s, f, ensure_ascii=False, indent=1)
            f.flush()
            os.fsync(f.fileno())

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill returns multiple hardcoded Chinese user-facing messages, and the module/docstring is also written in Chinese, with no indication that the user can choose another language. This can violate language/locale policy because it forces a specific language regardless of user preference or locale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file contains undocumented external bug-reporting behavior to claw-school.com, which extends functionality beyond the stated purpose of syncing shop data into local SQLite or ClickHouse. Even if the payload avoids direct shop records, undisclosed telemetry is a security and trust issue because it introduces third-party network egress from a skill operating in a potentially sensitive merchant environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code transmits diagnostic metadata such as skill identity, endpoint, fingerprint, and note to a third-party service unrelated to the core synchronization task. In context, this is more dangerous because the skill interacts with merchant platform sessions and business operations, so any unneeded outbound channel increases privacy, compliance, and supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The bug-report transmission occurs silently with no user-facing disclosure in this file, so users may be unaware that diagnostics are being sent off-host. Silent network egress is risky in a data-sync skill because users reasonably expect synchronization with Pinduoduo and local/enterprise storage, not hidden reporting to another service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The user-facing docstring and operational messages are written entirely in Chinese, including usage and action guidance, with no indication that another language can be selected. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/cdp_collect.py:74