ClawHub
Back to skill

Security audit

京东自营9.9包邮

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed shopping-query skill that sends product search parameters to a Tencent cloud proxy and does not show hidden local data access, persistence, or destructive behavior.

Install only if you are comfortable with shopping search terms and filter settings being sent to the publisher's Tencent cloud proxy to fetch JD product data. Avoid entering sensitive personal information as search text. The embedded proxy token should be rotated by the publisher, but the artifact does not show hidden persistence, local file access, or account-changing behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares environment-backed proxy configuration and describes cloud proxy forwarding to an external API, but no explicit permissions model is declared. This creates a transparency and governance gap: the skill can access secrets and make network requests without clearly signaling those capabilities to reviewers or users, which increases the risk of unnoticed data egress or misuse if the backend behavior changes.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The example invocations are broad, everyday shopping phrases that could match normal user requests not specifically intended for this skill. Over-broad triggers can cause accidental invocation, leading to unintended external requests, confusing results, or unnecessary disclosure of user shopping intent to the skill's backend.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill forwards user search parameters and an authentication token to an external Tencent SCF proxy, but nothing in the code indicates user notice, consent, or minimization of what is sent. In a shopping skill this is somewhat expected for functionality, but undisclosed third-party transmission still creates privacy and trust risk, especially if users enter sensitive terms.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.error

# ===== 配置 =====
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")
PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-ieoa5v7nf9.ap-guangzhou.tencentscf.com")
TOOL_NAME = "get_99_baoyou_items"
CHANNEL_NAME = "9.9包邮"
Confidence
91% confidence
Finding
The code reads a proxy credential from the environment and also embeds a hardcoded default token directly in source. That creates a real secret-management vulnerability: anyone with source access gets a usable credential, and if runtime environments are loosely controlled the skill can be repointed or abused with attacker-supplied secret material.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.