拼多多精选

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.1.1

Overview

The skill’s shopping functions match its stated purpose, but it routes queries through an external proxy using a hard-coded shared token and weak endpoint scoping.

Review before installing. Use this skill only if you trust the publisher and its proxy service with your product searches and product identifiers. The artifacts do not show local persistence or destructive actions, but the embedded shared token should be rotated or removed and the proxy destination should be tightly scoped.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:11

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 11–12 and 27–29
Vulnerability Type: Hard-coded reusable credential
Risk Level: High

Vulnerable Code

python

PROXY_URL = os.environ.get("PROXY_URL", "https://1439498936-1iog1h3lb1.ap-guangzhou.tencentscf.com")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

The embedded credential is subsequently transmitted to the proxy:

python

req = urllib.request.Request(
    PROXY_URL, data=data, method="POST",
    headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},
)

Technical Analysis

A reusable proxy authentication token is embedded directly in the distributed source code. Although environment variables can override it, the hard-coded token is used automatically when PROXY_TOKEN is absent. Anyone who can download or inspect the skill package can recover the credential without executing the code.

Because the token is sent as the X-Proxy-Token authentication header, an attacker can replay it in requests made directly to the configured Tencent Cloud Function endpoint. The proxy's server-side authorization, rate limits, and available request types could not be assessed from the supplied project, so the ultimate backend scope is not established.

Attack Path

1. Obtain the publicly or otherwise legitimately distributed skill package.
2. Inspect scripts/main.py.
3. Extract the default proxy URL and the token tp_8k2mX9vQ4z.
4. Construct an HTTPS POST request to the embedded proxy URL.
5. Supply the extracted token in the X-Proxy-Token header.
6. Replay supported proxy operations without possessing a separately issued credential.

Impact Assessment

Successful exploitation may permit unauthorized use of the proxy under the shared credential, potentially consuming service quota, creating operational cost, bypassing intended caller-level authentication, or interfering with ...[truncated 319 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the default token from source code and repository history.
2. Rotate or revoke the exposed token immediately.
3. Require PROXY_TOKEN to be supplied through an approved secret-management mechanism and terminate safely when it is unavailable.
4. Replace the shared static credential with per-user or per-installation credentials that are short-lived and narrowly scoped.
5. Enforce server-side authorization for each operation rather than treating possession of one shared token as sufficient authority.
6. Add rate limiting, usage quotas, request auditing, anomaly detection, and rapid credential-revocation controls at the proxy.
7. Prevent secrets from entering future releases by adding secret scanning to pre-commit checks and CI pipelines.
8. Keep only a non-sensitive endpoint identifier in source code; all authentication material should remain outside the distributed package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 29, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The code builds outbound HTTP requests using a proxy URL and token sourced from environment variables, then sends user-supplied query parameters to that destination. If an attacker or untrusted deployment can control PROXY_URL, the skill will exfiltrate product queries and the proxy credential to an arbitrary external service, effectively creating a server-side data egress channel.

Content

Scanner excerpt · scripts/main.py (reported line 34)May include surrounding context.

python

headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},
    )
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        err = ""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares tools that rely on environment variables for a proxy and inherently perform network access, but it does not specify any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for the platform to constrain what the skill may access or how credentials are used, especially because all data is routed through a proxy service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest display name, description, parameters, examples, and usage guidance are entirely presented in Chinese, with no indication that users may choose another language. This creates a locale/language constraint that is not documented as optional or justified as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example phrase "这个商品详情帮我看看" is common everyday speech and does not clearly constrain invocation to this specific skill. Without explicitly requiring a goods_sign or a clearer Pinduoduo-specific trigger, it could overlap with many unrelated shopping or general assistant contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill transmits user search terms, product identifiers, and an authentication token to an external proxy service, but there is no user-facing disclosure or consent mechanism. This creates a privacy and transparency issue, and if the proxy is third-party or compromised, user queries and metadata may be logged or misused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level natural-language description is entirely Chinese and presents the skill as Chinese-only, with no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.