京东自营9.9包邮

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 0.4.2

Overview

This shopping-query skill is mostly purpose-aligned, but it ships and uses a hard-coded shared proxy token for outbound requests.

Review carefully before installing. The skill does not appear malicious or persistent, but every query goes through the publisher’s Tencent Cloud proxy, and the package contains a reusable proxy token that should be treated as exposed and rotated by the publisher.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:16

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 16 and 28
Vulnerability Type: Hard-coded authentication credential
Risk Level: High

Vulnerable Code

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

The credential is subsequently placed in an outbound authentication header:

python

headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}

Technical Analysis

The script embeds a reusable proxy authentication token as the default value of PROXY_TOKEN. Although the environment can override it, any execution without an explicit environment value uses the credential distributed in the source code.

Source packages cannot provide confidentiality for embedded secrets. Anyone able to download or inspect the Skill can extract the token without running it. The token can then be supplied in an X-Proxy-Token header to the hard-coded Tencent Cloud Function endpoint.

The exposed token should be treated as compromised. The server-side authorization scope and controls were not available during this static audit, so access beyond the proxy's accepted operations is not established.

Attack Path

1. An attacker downloads or otherwise obtains the published Skill.
2. The attacker inspects scripts/main.py and extracts the default PROXY_TOKEN.
3. The attacker identifies the proxy endpoint from the adjacent PROXY_URL configuration.
4. The attacker constructs POST requests containing the extracted value in the X-Proxy-Token header.
5. If the token remains valid, the proxy accepts requests under the exposed credential, subject to its server-side authorization and rate limits.
6. The attacker may automate requests until the token is rotated, revoked, rate-limited, or otherwise rejected.

Impact Assessment

Successful exploitation may permit unauthorized use of the proxy and its exposed product-query functionality. Potential consequences include:

• Consumption of service quotas ...[truncated 516 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded fallback and require the token at runtime:

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
if not PROXY_TOKEN:
    raise RuntimeError("PROXY_TOKEN is required")

2. Immediately rotate or revoke the exposed token; deleting it from a future release does not invalidate copies already published.
3. Provision the replacement credential through a protected runtime secret manager rather than source code, metadata, documentation, command-line arguments, or repository files.
4. Prefer short-lived, narrowly scoped credentials. Authorize only the specific product-query operation required by this Skill.
5. Enforce server-side rate limits, quotas, request validation, and abuse monitoring per credential.
6. Avoid distributing a single shared static credential to all Skill installations. Where practical, issue per-installation or per-user credentials to support revocation and attribution.
7. Review proxy logs for unexpected use of the exposed token and alert on unusual request volume, source locations, parameters, or operation names.
8. Add automated secret scanning to source-control and release pipelines to prevent credentials from being packaged again.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python

headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes network and environment-variable capabilities through the tool definition (PROXY_URL, PROXY_TOKEN, and cloud proxy usage) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill harder to govern or sandbox, increasing the risk of unintended outbound requests or misuse of sensitive configuration if the runtime grants broader access than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code posts user-supplied query parameters to a remote SCF endpoint and includes an X-Proxy-Token header, but the file provides no user-facing warning, prompt, or logging that data is being transmitted off-host. The docstrings only describe querying via a proxy and do not disclose the outbound transmission behavior to the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's natural-language descriptions and user-visible messages are entirely in Chinese, and the skill does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.