京东自营新品首发

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 1.2.2

Overview

This skill is a JD product-search helper that sends shopping search parameters to a disclosed cloud proxy and does not show hidden local access, persistence, or destructive behavior.

Install only if you are comfortable with JD shopping queries, filters, and page parameters being sent to the publisher's Tencent Cloud proxy. The embedded shared proxy token should be rotated or replaced with a per-deployment secret by the publisher, and users should avoid sending sensitive personal information as search keywords.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:15

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, line 15
Vulnerability Type: Hard-coded secret in source code
Risk Level: Medium

Vulnerable Code

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

The token is subsequently used as an authentication header in scripts/main.py, lines 27–29:

python

payload = json.dumps({"tool": tool_name, "params": params}).encode("utf-8")
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")

Technical Analysis

The application embeds a default proxy authentication token directly in distributed source code. Although the PROXY_TOKEN environment variable can override it, installations without that variable automatically use the exposed credential.

Source code is not an appropriate secret-storage mechanism. Anyone who can download or inspect the Skill package can recover the token without executing the Skill. The token can then be supplied in the X-Proxy-Token header when making requests to the default Tencent SCF proxy endpoint.

Attack Path

1. An attacker obtains the publicly distributed or otherwise accessible Skill package.
2. The attacker opens scripts/main.py and extracts the default token from line 15.
3. The attacker identifies the default proxy endpoint from line 16.
4. The attacker constructs HTTP POST requests containing the extracted token in the X-Proxy-Token header.
5. If the server accepts the embedded token, the attacker invokes proxy functionality outside the intended Skill runtime until the credential is revoked, restricted, or rotated.

Impact Assessment

Successful exploitation could permit unauthorized use of the proxy service within the permissions assigned to the exposed token. Potential effects include consumption of service quotas, increased operating costs, rate-limit exha ...[truncated 315 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded fallback and require the token to be supplied through a protected environment variable or secret manager:

   python

   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   if not PROXY_TOKEN:
       raise RuntimeError("PROXY_TOKEN is required")
   

2. Rotate and revoke the exposed token because it must be treated as compromised after source distribution.
3. Provision separate, scoped credentials for deployments rather than sharing one token across all installations.
4. Restrict each token to the minimum required proxy method and resources.
5. Apply server-side rate limits, expiration, usage quotas, and anomaly monitoring.
6. Prevent tokens from appearing in source control, package artifacts, logs, exceptions, or diagnostic output.
7. Add automated secret scanning to development and release pipelines.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The request destination and authentication header are both sourced from environment variables and sent directly over the network without validation or allowlisting. If an attacker can influence PROXY_URL, the tool will exfiltrate the proxy token and all user query parameters to an arbitrary endpoint, turning this into a server-side data exfiltration/SSRF-style issue.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python

headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment-backed proxy configuration and describes cloud proxy forwarding, but it does not define any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where a network-capable skill may be granted broader access than intended, making review and enforcement harder if the tool or runtime changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation examples use very broad phrases like ordinary shopping requests, which can cause accidental triggering during normal conversation. If auto-invoked, the skill could send user queries to an external proxy/API without sufficiently clear user intent, creating privacy and control risks even though the functionality is limited to product lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sends user-supplied query parameters to a remote SCF proxy via HTTP POST and includes an authentication token in the request headers. While the function has an internal docstring, there is no user-facing print, prompt, or warning in this file disclosing that user input is transmitted to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest and module docstring say the tool shows curated items with 好评≥97% and 销量≥1000, but this function only forwards min_good_comments and never applies or forwards any minimum sales/orders constraint. As a result, the skill can return items outside the advertised '品质精选' criteria, creating a mismatch between claimed behavior and actual implementation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill description and all user-facing messages are written exclusively in Chinese, with no indication that the user can choose another language or locale. Under the stated policy, fixed language behavior without user opt-in can constitute a natural-language policy violation unless explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.