京东自营实时热销榜

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:33 AM UTC
• Version: 0.4.2

Overview

The skill’s shopping-query behavior is mostly coherent, but it ships a reusable proxy authentication token in code, creating a real review concern.

Review this before installing if you are comfortable with JD shopping searches being sent to a Tencent Cloud proxy. The main issue is for trust and service security: the package exposes a shared proxy token, so the publisher should remove and rotate it and use scoped runtime secrets instead.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:15

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 15 and 29–31
Vulnerability Type: Hard-coded authentication secret
Risk Level: High

Vulnerable Code

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

The embedded token is subsequently attached to requests:

python

payload = json.dumps({"tool": tool_name, "params": params}).encode("utf-8")
headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")

Technical Analysis

The source code contains a reusable proxy authentication token as the default value of PROXY_TOKEN. If the environment variable is absent, the application automatically authenticates to the configured Tencent Cloud Function endpoint using this embedded credential.

Because the token is distributed with the skill package, anyone able to read the package can extract it. Supporting an environment-variable override does not protect the exposed fallback credential. HTTPS protects the token while it is in transit but does not mitigate disclosure from source code.

An attacker can reproduce the request format shown in _scf_call, attach the disclosed value as the X-Proxy-Token header, and submit requests directly to the configured proxy. The exact server-side authorization boundaries are not available in the audited project, so access beyond the proxy functionality represented by this token cannot be confirmed.

Attack Path

1. Obtain or inspect the distributed skill package.
2. Open scripts/main.py and extract the fallback PROXY_TOKEN.
3. Identify the default proxy endpoint from PROXY_URL.
4. Construct an HTTPS POST request containing a JSON body in the expected form:

   json

   {
     "tool": "get_trending_items",
     "params": {}
   }
   

5. Set Content-Type: application/json and supply the disclosed credential through the X-Proxy-Token header.
6. Send requ ...[truncated 885 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded fallback and require the token at runtime:

   python

   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   if not PROXY_TOKEN:
       raise RuntimeError("PROXY_TOKEN is required")
   

2. Rotate and revoke the disclosed token immediately because it must be treated as compromised.
3. Provision credentials through a managed secret store or protected runtime environment rather than source control or distributed artifacts.
4. Issue distinct, scoped credentials per deployment or installation instead of sharing one global token.
5. Restrict each credential to the minimum required operation and backend resources.
6. Implement server-side expiration, rotation, revocation, request-rate limits, and usage quotas.
7. Validate allowed tool names and parameter constraints on the proxy; do not rely solely on client-side restrictions.
8. Monitor proxy logs for anomalous sources, excessive request rates, and use of the exposed credential.
9. Add automated secret scanning to development and release pipelines to prevent credentials from entering future packages.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 33)May include surrounding context.

python

headers = {"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN}
    req = urllib.request.Request(PROXY_URL, data=payload, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except (socket.timeout, TimeoutError):
        return {"ok": False, "error": "timeout"}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares environment-backed network access via a proxy but does not define any explicit tool scope, permissions, or allowed-tools boundary. This creates unnecessary ambiguity about what execution and external communication capabilities the skill may use, which weakens reviewability and increases the risk of over-privileged or unintended network behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation examples use very broad natural-language phrases like asking what is popular now, which can overlap with ordinary conversation and make the skill trigger unintentionally. Accidental invocation can cause unexpected external requests and product-query behavior without clear user intent, especially because the skill reaches a remote proxy-backed service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill forwards user-supplied search terms and filters to a third-party remote proxy service, but the user-facing behavior shown here does not disclose that their query leaves the local agent boundary. This creates a privacy and transparency issue, especially because search keywords may contain sensitive interests or inadvertent personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language description and all user-facing messages in the script are written exclusively in Chinese, which implies a fixed language/locale experience. There is no indication that the user can opt into another language or choose locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.