ClawHub
Back to skill

Security audit

京东自营新品首发

Security checks across malware telemetry and agentic risk

Overview

This skill is a JD shopping search helper that sends search filters to a disclosed cloud proxy and formats returned product results, with no evidence of destructive or hidden behavior.

Install only if you are comfortable with JD shopping queries and filters being sent through the publisher's Tencent cloud proxy. The publisher should ideally remove the hardcoded default token, lock the proxy destination, and document retention more clearly, but the reviewed artifacts do not show hidden collection, persistence, or destructive actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}
Confidence
97% confidence
Finding
The request destination and authentication token are both sourced from environment variables and then used in an outbound HTTP request without validation or allowlisting. If an attacker can influence PROXY_URL or deployment configuration, the skill can be redirected to an attacker-controlled endpoint and will transmit the X-Proxy-Token, enabling SSRF-like behavior and credential leakage.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares environment variables for a proxy URL and authentication token and explicitly states that data is forwarded through a cloud proxy, but no corresponding permissions are declared. This creates a transparency and governance gap: the skill can access networked infrastructure and secrets without clearly signaling that capability to reviewers or users, which increases the risk of hidden data exfiltration or misuse if the proxy is compromised or repurposed.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The example trigger phrases are broad everyday shopping queries such as asking what new items JD has or requesting discounted products. Overly generic invocation patterns can cause accidental activation in normal conversation, leading to unintended external queries and disclosure of user shopping intent to the backing service.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill accesses a proxy credential and silently forwards user queries to an external Tencent SCF endpoint, but the code provides no user-facing disclosure or consent mechanism for that data transfer. In a tool that handles user-supplied search terms, undisclosed third-party transmission creates a privacy and trust risk, especially because the proxy layer is central to all requests.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.error

# ===== 配置 =====
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")
PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-bhwwttt26z.ap-guangzhou.tencentscf.com")
TOOL_NAME = "get_new_arrivals"
CHANNEL_NAME = "新品首发"
Confidence
95% confidence
Finding
The code reads a sensitive token from the environment and also embeds a real-looking default token directly in source. This is dangerous because a missing environment variable causes use of a hardcoded secret, which can be extracted from the repository, abused by anyone with code access, and reused to access the proxy service.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.