ClawHub
Back to skill

Security audit

京东自营历史最低价

Security checks across malware telemetry and agentic risk

Overview

This skill is a shopping search helper that sends limited product-query filters to a disclosed Tencent Cloud proxy to retrieve JD product deals.

Install only if you are comfortable with your JD shopping search terms and filters being sent to the skill publisher's Tencent Cloud proxy. Avoid entering personal information as keywords, and treat returned buying links as external shopping links to review before opening or purchasing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}
Confidence
96% confidence
Finding
The code sends user-supplied query parameters and an authentication token to a remote proxy endpoint whose URL is controlled by an environment variable and defaults to an external Tencent SCF address. This creates a real exfiltration and SSRF-style trust-boundary issue: if PROXY_URL is changed or the remote proxy is compromised, user queries and the proxy token are disclosed to an attacker-controlled service.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares environment-based proxy settings and explicitly routes requests through a cloud proxy, but it does not declare permissions or clearly bound its network/data-access behavior. This creates a trust and review gap: the skill can transmit user queries and potentially use injected secrets or external services without transparent permission disclosure, making misuse or data exfiltration harder to detect.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger examples are broad enough to match ordinary shopping conversation, which can cause the skill to activate when a user did not clearly intend to invoke it. Unintended invocation can leak conversational context or send shopping-related queries to the skill's backend/proxy, especially relevant here because the skill uses networked data retrieval via a proxy service.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill forwards user search terms, price filters, and other request parameters to an external proxy service, but the code provides no mechanism for user notice or consent at the point of collection. This is a privacy and transparency issue because users may reasonably believe the query is handled locally rather than transmitted to a third-party service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.