ClawHub
Back to skill

Security audit

淘宝精选

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Taobao/Tmall shopping search helper, with some privacy and secret-handling caveats around its proxy service.

Install only if you are comfortable sending Taobao/Tmall search terms, price filters, and paging choices to the publisher-operated proxy. Avoid overriding PROXY_URL unless you fully trust the endpoint, and prefer a properly managed PROXY_TOKEN instead of relying on the embedded fallback token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill declares tool environment variables and clearly relies on remote network access, but no explicit permissions model is declared. This creates a transparency and governance gap: users and platforms may not realize that search queries and filtering inputs are being sent off-platform to external services. In a shopping skill, this is moderately risky because user intent, product interests, and possibly affiliate-related data are exposed to a backend without clear permission signaling.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill description presents itself as a straightforward Taobao/Tmall search tool, but the actual behavior includes routing requests through an external proxy service and using proxy authentication material. That mismatch is dangerous because it undermines informed consent and can conceal third-party data handling, traffic inspection, logging, or backend behavior not apparent to users. In this context, shopping queries may seem low sensitivity, but they still reveal consumer interests, budgets, and possibly affiliate monetization flows.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
A default proxy token is hardcoded directly in the script, which exposes a secret in source code and makes accidental reuse likely across deployments. Anyone with code access can extract the token and attempt unauthorized use of the proxy service, and rotating the credential becomes harder once embedded.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill automatically attaches a proxy token to every outbound request without any transparency or separation of duties, so the embedded credential is silently used whenever the tool runs. In a skill context, this increases the chance of credential abuse, unintended third-party calls, and operational exposure if users or hosts can influence where requests are sent.

VirusTotal

39/39 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.