ClawHub
Back to skill

Security audit

京东自营超级补贴

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a shopping-deals proxy tool, but it ships a reusable proxy token and leaves the remote proxy authority under-scoped.

Review this before installing if you are not comfortable with searches being sent through the publisher's Tencent Cloud proxy. The main user risk is not local system compromise, but the package contains a shared proxy credential and relies on the remote service for filtering and data-handling promises.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/main.py:14
Finding

Hard-Coded Proxy Authentication Token in Distributed Source Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill declares environment-backed proxy configuration and describes cloud proxy/API forwarding, but does not explicitly constrain tool scope with permissions or allowed-tools. That creates an unnecessary trust gap: the runtime may expose broader network or secret-access capabilities than users or reviewers can verify from the manifest, increasing the risk of unintended outbound requests or misuse of proxy credentials.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

文件头注释明确声明“仅筛选京东自营商品，好评≥98%、销量≥5000的品质精选”，给人以这些约束由当前技能保证执行的印象。但本地代码只把 min_good_comments 作为参数传给远端，且完全没有对 inOrderCount30Days >= 5000 做任何校验或过滤，实际结果是否满足这些条件取决于外部 SCF 服务。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

A hardcoded default proxy token and URL enable authenticated outbound requests even when secure deployment configuration is missing. This creates unauthorized reuse risk, makes credential rotation harder, and can expose a live backend capability to anyone who obtains the skill code or package.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

manifest 描述中承诺当结果不足时会自动降级以保证推荐，但 tool_get_deals 在无结果时仅返回“未找到”提示，并未修改关键词、价格、排序、好评门槛或发起二次降级查询。代码中的唯一重试是超时重试，这与“结果不足时自动降级”是不同语义。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The module docstring and all user-facing messages are written only in Chinese, which implies a fixed language/locale experience. The file does not provide any language choice, opt-in, or explicit justification that the skill is intended only for Chinese-speaking or region-specific users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.