ClawHub
Back to skill

Security audit

京东自营超级补贴

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed shopping lookup tool that sends search filters to a cloud proxy and returns JD product data, with no evidence of local data access, persistence, purchasing, or destructive behavior.

Install only if you are comfortable sending JD shopping search terms and filters to the publisher's Tencent Cloud proxy. Avoid entering private personal details as keywords, and be aware that the embedded proxy token and configurable proxy URL are weak engineering choices even though they do not show malicious behavior here.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}
Confidence
93% confidence
Finding
The request URL and authentication header are both sourced from environment-controlled values and then sent via urllib without validation. If an attacker can influence PROXY_URL or the deployment environment, they can redirect requests and the X-Proxy-Token to an attacker-controlled host, causing credential leakage and unintended outbound data exfiltration.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares environment variables for a proxy endpoint and token and explicitly routes requests through a cloud proxy, but no permissions are declared to signal network or secret usage. This creates a transparency and governance gap: the skill can transmit user queries and use credentials without clear permission disclosure, increasing the risk of data exfiltration, policy bypass, or unsafe trust in the proxy layer.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The example invocations are broad, natural phrases such as generic shopping queries, which can cause the skill to activate when a user did not specifically intend to use it. In a commerce context, unintended invocation can drive unsolicited product recommendations and send user search terms to the backend proxy or upstream API without a sufficiently explicit user action.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.error

# ===== 配置 =====
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")
PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-ebgg6n6ain.ap-guangzhou.tencentscf.com")
TOOL_NAME = "get_deals"
CHANNEL_NAME = "超级补贴"
Confidence
91% confidence
Finding
Reading secrets from environment variables is normal, but this instance includes a hardcoded default proxy token that will be used if no secret is configured. That creates a credential exposure risk, makes accidental insecure deployments likely, and pairs dangerously with the externally configurable PROXY_URL because the token may be sent to an untrusted endpoint.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.