ClawHub
Back to skill

Security audit

京东自营秒杀

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent JD shopping lookup tool, but users should understand it sends searches through a Tencent Cloud proxy and returns remote product links/images.

Install only if you are comfortable with your search terms being sent to the configured Tencent Cloud proxy and with product images and purchase links loading from remote URLs. The publisher should remove the hardcoded fallback token, rotate it, and validate returned JD URLs, but the inspected artifacts do not show hidden persistence, local data theft, or destructive actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:16
Finding

Hard-Coded Proxy Authentication Token

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py, line 16
Vulnerability Type: Hard-coded credential
Risk Level: Medium

Vulnerable Code:

python
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

Technical Analysis

The source code embeds a default authentication token for the remote Tencent SCF proxy. When the PROXY_TOKEN environment variable is absent, every installation uses this shared credential.

Secrets distributed in source packages cannot be considered confidential. Any person who downloads or otherwise reads the Skill can recover the token without executing the code. The token is subsequently transmitted in the X-Proxy-Token request header by _scf_call.

Attack Path

  1. An attacker downloads or gains read access to the publicly distributed Skill.
  2. The attacker inspects scripts/main.py and extracts the default proxy token.
  3. The attacker identifies the proxy URL from the adjacent configuration.
  4. The attacker constructs requests containing the recovered token in the X-Proxy-Token header.
  5. If the server accepts the shared token, the attacker can access or abuse the proxy under the Skill's identity until the credential is revoked or rotated.

Impact Assessment

Successful exploitation may permit unauthorized use of the remote proxy with the same service-level authorization granted to the embedded token. The likely scope includes unauthorized API requests, quota or resource exhaustion, service disruption, and attribution of attacker traffic to legitimate Skill users.

The code does not establish that this credential provides host, operating-system, administrative, or broader cloud-account privileges. The maximum confirmed scope is therefore limited to whatever capabilities the remote proxy assigns to this token.

Remediation
View remediation

Remediation Suggestions

  • Remove the embedded fallback token and rotate the exposed credential immediately.
  • Require PROXY_TOKEN to be supplied through an approved runtime secret-management mechanism.
  • Fail closed with a clear configuration error when the token is unavailable.
  • Issue scoped, short-lived, and preferably per-user or per-installation credentials rather than a shared static token.
  • Restrict each credential to the required proxy operation and enforce rate limits, expiration, revocation, and request auditing.
  • Add automated secret scanning to release and CI pipelines to prevent future credential inclusion.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/main.py:66
Finding

Unvalidated Remote Product and Image URLs Returned to Clients

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 66-85
Vulnerability Type: Insufficient validation of remotely supplied URLs
Risk Level: Low

Vulnerable Code:

python
material_url = g.get("materialUrl", "")
if material_url and not material_url.startswith("http"):
    material_url = "https://" + material_url

coupon = float(g.get("lowestCouponPrice", 0) or 0)
ref = float(g.get("price", 0) or 0)
if coupon <= 0:
    coupon = float(g.get("lowestPrice", 0) or ref or 0)
if ref <= 0:
    ref = float(g.get("lowestPrice", 0) or 0)
discount_pct = round((ref - coupon) / ref * 100, 1) if ref > 0 and coupon > 0 and ref > coupon else 0

return {
    "name": g.get("skuName", ""),
    "price": ref,
    "coupon_price": coupon,
    "discount_percent": discount_pct,
    "shop_name": shop_name,
    "brand_name": g.get("brandName", ""),
    "is_self": bool(is_jd),
    "tags": [t for t in g.get("skuTags", []) if t not in NOISE_TAGS],
    "image_url": g.get("imageUrl", ""),
    "buy_url": material_url,

The associated rendering guidance appears in SKILL.md, lines 90-91:

markdown
4. Each product includes a product image URL (`image_url`), rendered with `![Product name](image_url)`
5. Purchase links automatically identify the device and may open the JD application on mobile devices

Technical Analysis

Product data originates from a remote proxy, but materialUrl and imageUrl are passed to clients without structural URL parsing or destination allowlisting. The purchase URL logic only checks whether the value begins with the characters http. Consequently, arbitrary HTTP or HTTPS hosts can be returned, and plaintext HTTP URLs remain accepted.

The image URL receives no validation. Because the documentation encourages clients to render it, a malicious or compromised upstream response could cause a client to contact an attacker-controlled server. Thi ...[truncated 1386 chars]

Remediation
View remediation

Remediation Suggestions

  • Parse URLs with a standards-compliant URL parser instead of using prefix checks.
  • Permit only the https scheme and reject plaintext HTTP and all non-web schemes.
  • Maintain an explicit allowlist of trusted JD purchase and image hostnames.
  • Normalize hostnames before comparison and reject malformed URLs, embedded credentials, unexpected ports, and deceptive subdomain suffixes.
  • Validate imageUrl and materialUrl independently before including them in output.
  • Avoid automatic rendering of remote images unless the client obtains user consent or uses a trusted image proxy with privacy and network controls.
  • Consider generating purchase links on a trusted server rather than accepting destinations directly from upstream product data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares network and environment-variable capabilities via a proxy-based tool, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege guarantees and makes it harder for the platform or reviewers to verify what external access the skill actually needs, increasing the risk of unintended data exposure or unauthorized outbound requests if the implementation changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are very generic shopping-language prompts such as asking what deals are available or requesting cheap items. Broad triggers can cause the skill to activate in contexts where the user did not clearly intend to use this specific skill, creating prompt-routing confusion and increasing the chance that shopping requests are intercepted unnecessarily.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file's natural-language strings, summaries, usage text, and responses are all hard-coded in Chinese, with no mechanism for user language selection or documented locale constraint. This can violate language/locale policy when a skill unconditionally forces one language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill contains a default proxy authentication token in source code and automatically uses it for outbound requests. Hardcoded fallback credentials are dangerous because they can be extracted from the skill, reused by others, and may grant unauthorized access to the proxy service or enable abuse billed to the owner.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code sends user-supplied search parameters to a remote SCF proxy and includes an X-Proxy-Token header, but there is no user-facing print, prompt, or warning explaining that data will be transmitted off-host. The module docstring describes the feature at a high level, but it does not disclose the network transmission or credential use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The skill is entirely presented in Chinese and tightly centered on the JD shopping context, but it does not state that it is intended specifically for Chinese-speaking users or offer any language/locale choice. For policy review, this can be a locale/language constraint that should be explicit or user-selected rather than implicitly enforced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script reads PROXY_TOKEN from the environment and uses it for outbound authentication, but there is no warning or documentation in this file informing users that a credential is consumed. Under the rule, access to sensitive environment variables should have some form of disclosure unless already clearly documented elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.