淘宝精选

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.1.2

Overview

The skill is a coherent Taobao shopping search tool, but it ships a reusable proxy token and can send searches through an externally configured proxy, so it needs review before installation.

Review this skill before installing. It does not show malware-like persistence or account actions, but installing it means shopping queries are sent to a proxy service, and the packaged code exposes a reusable proxy token. The publisher should remove and rotate the embedded token, require secure runtime configuration, and restrict proxy destinations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:11

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, line 11
Vulnerability Type: Hardcoded reusable authentication secret
Risk Level: Medium

python

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

Technical Analysis

The source code contains a reusable proxy authentication token as the default value for PROXY_TOKEN. Although the environment can override this value, the embedded credential is used whenever the variable is absent. Any party with access to the distributed skill can recover the token without executing the code.

The token is subsequently placed in the X-Proxy-Token header of requests sent to the public proxy endpoint. This creates a credential-disclosure and unauthorized-use risk because possession of the packaged source is sufficient to obtain the default credential.

Attack Path

1. An attacker downloads the skill package or otherwise reads scripts/main.py.
2. The attacker extracts the hardcoded proxy token and the public proxy URL.
3. The attacker constructs direct HTTPS requests to the proxy and supplies the token through the X-Proxy-Token header.
4. If the server accepts the exposed token, the attacker submits unauthorized proxy requests independently of the skill.
5. The attacker can continue consuming proxy-backed resources until the credential is revoked, expires, or is blocked by server-side controls.

Impact Assessment

Successful exploitation may permit unauthorized use of the proxy-backed product-search service. The practical scope can include API quota consumption, resource-cost increases, abusive traffic, and reduced availability for legitimate users.

No evidence establishes that this token grants local system privileges, access to end-user accounts, or arbitrary code execution. The exact server-side permissions cannot be determined from the audited repository and depend on the proxy's authorization controls.

Remediation

View remediation

Remediation Suggestions

1. Remove the hardcoded fallback and require the credential at runtime:

   python

   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   if not PROXY_TOKEN:
       raise RuntimeError("PROXY_TOKEN is required")
   

2. Immediately revoke and rotate the exposed token.
3. Store credentials in an approved secret manager or protected runtime configuration rather than source code or distributed packages.
4. Issue separate, short-lived, narrowly scoped credentials per user or installation instead of sharing a global token.
5. Enforce server-side authorization, expiration, rate limits, quotas, request validation, and abuse monitoring.
6. Review proxy logs for unexpected use of the exposed credential and invalidate associated sessions or derived credentials where applicable.
7. Add automated secret scanning to development and release pipelines to prevent future credential publication.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tainted flow: 'req' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The request destination is taken from the PROXY_URL environment variable and sent to urllib without any allowlist or validation, so whoever controls the environment can redirect all queries and the X-Proxy-Token header to an arbitrary server. Because the code also includes a default token and always transmits it with requests, this creates an SSRF-style outbound connection plus credential exfiltration risk.

Content

Scanner excerpt · scripts/main.py (reported line 25)May include surrounding context.

python

method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=TIMEOUT) as r:
            return json.loads(r.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        err = ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill’s documented behavior relies on an external proxy service for core logic, yet that dependency and its security properties are not transparently specified or auditable from the supplied file. This creates a trust gap: user queries and possibly tokens are sent to a remote intermediary whose filtering, ranking, logging, and data handling cannot be verified, while the skill makes strong claims about sorting, filtering, and privacy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares network- and environment-dependent tool behavior but does not define any explicit tool scope such as permissions or allowed-tools. That weakens governance and reviewability, making it harder to constrain what the skill may access and increasing the risk of overbroad external calls or secret exposure through env-backed tooling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation examples include common shopping requests like “帮我搜一下iPhone 16”, “1000元以内的电视”, and “夏季连衣裙推荐”, but the document does not define explicit trigger boundaries or exclusion conditions. In a manifest/markdown skill description, such broad natural phrases can overlap with ordinary conversation and make activation scope unclear.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-visible strings throughout the file are exclusively in Chinese, and the skill does not provide any mechanism for language selection or document a justified locale restriction. This is a natural-language policy concern because it forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill contains credential handling and a hardcoded fallback token in source code, which is a real secret-management flaw regardless of business purpose. If the repository, logs, or runtime are exposed, the token can be reused to access the proxy service or impersonate this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code reads a proxy token from environment variables and sends it in an HTTP header to a remote service, but there is no user-facing print/log, confirmation, or warning comment explaining that network requests and credential-backed proxy access will occur. For a code file, this matches the missing-warning criterion for sensitive environment variable access combined with outbound data transmission.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.