拼多多实时热销榜

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:36 AM UTC
• Version: 1.1.1

Overview

This shopping-ranking skill mostly matches its stated purpose, but it should be reviewed because it ships a reusable proxy token and can send that token to a configurable network endpoint.

Review this skill before installing. It appears limited to product-list queries and does not modify local files or accounts, but its bundled proxy token should be treated as exposed, and users should be comfortable with product search/filter parameters being sent through the publisher's proxy service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:9

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:9-19
Vulnerability Type: Hard-coded credential and credential disclosure through a configurable endpoint
Risk Level: High

Vulnerable Code

python

PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-cv2nww3ykf.ap-guangzhou.tencentscf.com")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")
TIMEOUT = 30


def _call_proxy(tool_name, params):
    """Call the SCF proxy using the type+params format."""
    body = json.dumps({"type": tool_name, "params": params}).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=body, method="POST",
        headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},
    )

Technical Analysis

The source code contains a default proxy authentication token. Because the project distributes this source, any party able to obtain the package can extract the token without needing runtime access to a protected secret store.

The token is transmitted in the X-Proxy-Token HTTP header. The destination URL is independently controlled through the PROXY_URL environment variable, while the embedded token remains active whenever PROXY_TOKEN is not overridden. An attacker who can influence the process environment can therefore redirect a legitimate invocation to an attacker-controlled HTTPS endpoint and capture the credential. Independently of that redirection scenario, the exposed token can be copied directly from the source and tested against the default proxy.

The repository does not reveal the proxy's server-side authorization policy, so the exact permissions and validity of the token cannot be established from the audited files. Nevertheless, embedding a reusable authentication token in client-distributed code violates secret-management and least-exposure principles.

Attack Path

1. Obtain or inspect the distributed Skill package.
2. Read `scripts/ma ...[truncated 1347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the default token from source code and require PROXY_TOKEN to be supplied through a protected runtime secret store.

2. Immediately rotate or revoke the exposed token because deleting it from a later revision does not remove it from existing packages or repository history.

3. Fail closed when the token is absent rather than silently using a shared fallback:

   python

   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   if not PROXY_TOKEN:
       raise RuntimeError("PROXY_TOKEN must be supplied through the runtime secret store")
   

4. Do not allow an arbitrary endpoint to receive credentials. Fix the proxy origin in trusted configuration or validate PROXY_URL against an explicit HTTPS hostname allowlist before attaching the authentication header.

5. Scope replacement credentials to only the product-list operation and apply short expiration, rotation, per-installation identity, request quotas, and server-side rate limiting.

6. Monitor proxy logs for prior misuse of the exposed token, including unusual request volume, source addresses, parameters, and invocation times.

7. Avoid logging authentication headers and redact the token from exception telemetry, diagnostics, and support bundles.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tainted flow: 'req' from os.environ.get (line 18, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/main.py (reported line 23)May include surrounding context.

python

headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},
    )
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        err = ""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares environment variables for a proxy endpoint and token and explicitly describes cloud proxy forwarding to an external API, but it does not declare any tool scope restrictions such as permissions or allowed-tools. This creates a governance gap: the skill can access network-capable functionality and secrets without an explicit least-privilege boundary, making misuse, unintended data egress, or secret exposure harder to prevent and audit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill embeds a default external proxy endpoint and a hardcoded proxy token, which creates an unauthorized data-sharing channel and exposes a credential to anyone with code access. Because the skill's stated purpose is simple product listing, routing all requests through a third-party proxy is higher risk and not transparently justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code sends user-supplied search parameters to an external proxy service without any disclosure in the skill logic or visible consent mechanism. Even if the parameters seem low sensitivity, they can still reveal user interests or usage patterns and create unnecessary third-party exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

User-visible strings throughout the file, including the module description, usage messages, errors, and formatted results, are exclusively in Chinese. There is no indication that the user can opt into this locale or choose another language, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.