ClawHub
Back to skill

Security audit

京东自营实时热销榜

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned for JD shopping trend lookup, but its proxy configuration can send a proxy token and user queries to an unvalidated URL.

Install only if you trust the publisher and the configured proxy endpoint. Verify PROXY_URL points to the intended HTTPS service, avoid putting sensitive personal details in shopping queries, and prefer explicit JD/ranking prompts so the skill does not run on casual shopping conversation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}
Confidence
92% confidence
Finding
The request destination and authentication header are both derived from environment variables, and the code sends the X-Proxy-Token to whatever URL PROXY_URL contains without validating or allowlisting the host. In a skill/runtime environment where env vars can be influenced, this can exfiltrate the proxy credential to an attacker-controlled endpoint and redirect all fetched data through an untrusted server.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares environment-backed proxy configuration and explicitly describes cloud proxy forwarding to retrieve external data, which implies network and secret usage without an explicit permissions model. This creates a trust gap: users and reviewers are not clearly informed that queries may be transmitted to a third-party proxy using hidden credentials, increasing risk of unintended data disclosure or overbroad network access.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The example phrases are very broad, everyday shopping language such as asking what is popular now, which could match casual user conversation and trigger the skill unintentionally. Unintended invocation can cause silent data transmission to the external proxy/API and produce actions or disclosures the user did not explicitly request from this specific skill.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.