ClawHub
Back to skill

Security audit

京东自营秒杀

Security checks across malware telemetry and agentic risk

Overview

This shopping skill is purpose-aligned and disclosed, but users should understand that search parameters are sent to a cloud proxy.

Install only if you are comfortable with your JD seckill search filters being sent to the publisher's Tencent Cloud proxy to retrieve product data. Avoid putting personal or sensitive information in search keywords. The skill does not buy items, change accounts, persist locally, or access local credentials, but the publisher should improve secret handling and proxy scoping.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}
Confidence
94% confidence
Finding
The request target and authentication header are both sourced from environment-controlled values, and the code sends user query parameters plus the proxy token to whatever URL is configured in PROXY_URL. If that environment variable is changed to an attacker-controlled endpoint, the token and request data are exfiltrated and the skill's network trust boundary is broken.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares environment-backed proxy configuration and explicitly relies on cloud proxy/network access, but no corresponding permissions are declared. This creates a transparency and governance gap: the runtime can transmit user queries and use secrets without users or reviewers having a clear permission contract. In a shopping skill that forwards searches to a third-party proxy, this increases risk of unintended data exposure and weakens reviewability of outbound access.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The example trigger phrases are generic shopping utterances like asking what deals are available or requesting items under a price threshold. Broad triggers can cause accidental invocation during ordinary conversation, leading the assistant to activate the skill without clear user intent and potentially send shopping queries to external services. Because this skill uses network/proxy-backed retrieval, overbroad activation has more consequence than a purely local skill.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.error

# ===== 配置 =====
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")
PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-23pvh3iikx.ap-guangzhou.tencentscf.com")
TOOL_NAME = "get_seckill_items"
CHANNEL_NAME = "京东秒杀"
Confidence
97% confidence
Finding
The code retrieves a proxy token from the environment and also embeds a default token directly in source. This creates a real credential-handling weakness: if the environment variable is unset, a reusable secret from code is sent on outbound requests, enabling unauthorized use of the proxy if the code is exposed or reused.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.