京东精选

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 1.2.2

Overview

This is a coherent JD shopping lookup skill, but it ships and automatically uses a hard-coded shared proxy authentication token.

Install only if you are comfortable with the skill sending shopping queries to the publisher's Tencent Cloud proxy. The publisher should remove and rotate the embedded proxy token, fail closed when no runtime token is provided, and narrow activation phrasing to reduce accidental commercial routing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:20

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 20 and 126–128
Vulnerability Type: Hard-coded secret in distributed source code
Risk Level: Medium

Vulnerable Code

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

The embedded token is subsequently added to requests sent to the proxy endpoints:

python

payload = json.dumps({"type": "jingfen", "params": params}).encode("utf-8")
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
req = urllib.request.Request(proxy_url, data=payload, headers=headers, method="POST")

Technical Analysis

The application reads PROXY_TOKEN from the environment but falls back to a static authentication token embedded directly in the source code. Because the Skill package is distributed to users, the fallback token must be considered publicly exposed.

An attacker can extract the token without executing the Skill and use it outside the intended client. If the backend treats this shared token as sufficient authorization, possession of the package grants the attacker the same proxy access associated with the Skill. Environment-based configuration does not mitigate the exposed fallback because the literal remains valid unless it has been revoked server-side.

Attack Path

1. Download or otherwise obtain the published Skill package.
2. Inspect scripts/main.py and extract the fallback value assigned to PROXY_TOKEN at line 20.
3. Identify the fixed Tencent Cloud Function endpoints from the CHANNELS configuration.
4. Construct POST requests using the expected JSON payload and set the extracted value in the X-Proxy-Token header.
5. Submit arbitrary supported proxy queries independently of the intended Skill runtime.
6. Repeatedly invoke the endpoints to consume backend resources or quota, subject to server-side validation and rate limits.

Impact Assessment

Successful exploitation may allow unauthorized use of the proxy service wit ...[truncated 584 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded fallback and require the credential to be supplied through secure runtime secret injection:

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
if not PROXY_TOKEN:
    raise RuntimeError("PROXY_TOKEN is required")

2. Revoke and rotate the exposed token immediately; removing it from a later source revision does not invalidate copies already distributed.
3. Store the replacement in a managed secret store and avoid placing it in source code, package metadata, logs, examples, or error messages.
4. Do not rely on a secret embedded in client-distributed code as the sole authorization control. Where feasible, issue short-lived, narrowly scoped credentials at runtime.
5. Enforce server-side request validation, endpoint and operation scoping, quotas, rate limits, abuse detection, and credential rotation.
6. Add automated secret scanning to source-control and release pipelines to prevent future credential publication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 114, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 116)May include surrounding context.

python

headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(proxy_url, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares environment-backed proxy access and implicitly performs networked data retrieval, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens platform-level containment and reviewability, because consumers and policy engines cannot clearly verify what execution capabilities the skill is intended to use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Single-word aliases like '秒杀', '补贴', or '新品' are highly ambiguous and can be triggered in many unrelated contexts, making accidental activation likely. Because this skill also routes users to external shopping content, vague aliases increase the risk of intent capture and unwanted commercial redirection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger examples are broad enough to match ordinary shopping language such as generic requests for 'good products,' which can cause unintended invocation or routing collisions with other commerce skills. In an assistant ecosystem, overly generic triggers can hijack user intent, creating confusing behavior and potentially steering users toward this skill without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code embeds a default proxy token directly in source and uses it automatically when the environment variable is absent. Anyone with code access can recover and reuse that credential to call the backend proxy, which can enable unauthorized use, quota exhaustion, or abuse of the associated service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

User-facing docstrings, summaries, errors, and prompts in this file are exclusively Chinese, and the code provides no mechanism for language selection or opt-in. Under the stated policy, forcing a specific language without offering choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.