Skills

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:18 PM UTC
• Version: 1.0.0

Overview

This skill matches its WooCommerce import purpose, but it can modify store catalog data and run an unpinned MCP startup package while handling an API key.

Review this before installing on a live store. Use a narrowly scoped, revocable Yundian API key; keep the API URL set only to the intended trusted HTTPS origin; avoid bulk imports unless you have checked the source and target behavior; and prefer a version that pins dependencies, includes a lockfile, and runs a local installed `tsx` binary instead of `npx -y`.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22
• Finding: Automatic Execution of an Unpinned Runtime Package## Vulnerability Details **File Location**: `SKILL.md`, lines 22-23 **Vulnerability Type**: Unpinned third-party package retrieval and execution **Risk Level**: High ### Vulnerable Code ```json "command": "npx", "args": ["-y", "tsx", "{baseDir}/mcp-server.ts"], ``` ### Technical Analysis The MCP configuration invokes `npx -y tsx` without specifying a package version. The `tsx` package is also absent from `package.json`, meaning `npx` can retrieve it dynamically from the configured npm registry when the server starts. The `-y` option suppresses the normal installation confirmation. Consequently, the code executed at startup is not fully represented by the audited project. Its effective behavior can change after review because package resolution depends on the registry state, npm configuration, cache state, and available package versions. ### Attack Path 1. An attacker compromises the upstream `tsx` package, its maintainer account, the configured npm registry, or the package-resolution channel. 2. A malicious or otherwise compromised release becomes the version selected by the unpinned `npx` invocation. 3. The user starts the MCP server according to the documented configuration. 4. `npx -y` downloads and executes the selected package without an interactive confirmation. 5. The package executes with the operating-system privileges and environment of the MCP process. ### Impact Assessment Successful exploitation permits arbitrary code execution under the account running OpenClaw or the MCP server. This can expose environment variables—including `YUNDIAN_WOO_IMPORTER_API_KEY`—and any files, network resources, or local processes accessible to that account. The code could also alter local files or interfere with MCP communications. This does not inherently provide administrator privileges, but its scope equals the privileges granted to the Agent process.
• Remediation: ## Remediation Suggestions 1. Add `tsx` to `package.json` using an exact, reviewed version rather than a range. 2. Generate and commit a `package-lock.json` containing integrity hashes. 3. Install dependencies with `npm ci` from the committed lockfile. 4. Invoke the project-local executable, such as `node_modules/.bin/tsx`, instead of allowing `npx` to download packages automatically. 5. Remove the `-y` automatic-download workflow from the documented MCP configuration. 6. Use a trusted registry and consider restricting installation scripts where operationally feasible.

T08 · Insecure Dependencies

Warning

• Location: package.json:6
• Finding: Non-Reproducible Dependency Resolution## Vulnerability Details **File Location**: `package.json`, lines 6-8; related installation instruction at `SKILL.md`, line 5 **Vulnerability Type**: Unlocked and loosely versioned dependency **Risk Level**: Medium ### Vulnerable Code `package.json`, lines 6-8: ```json "dependencies": { "@modelcontextprotocol/sdk": "^1.0.0" } ``` Related installation configuration in `SKILL.md`, line 5: ```yaml metadata: { "openclaw": { "requires": { "env": ["YUNDIAN_WOO_IMPORTER_API_KEY"], "bins": ["node", "npm", "npx"] }, "primaryEnv": "YUNDIAN_WOO_IMPORTER_API_KEY", "emoji": "🛍️", "homepage": "https://ydplus.net", "install": "npm install" } } ``` No dependency lockfile is present in the audited project. ### Technical Analysis The caret range `^1.0.0` permits npm to install later compatible releases of `@modelcontextprotocol/sdk`. The documented `npm install` operation is not backed by a committed lockfile, so installations performed at different times can resolve to different dependency versions and transitive dependency trees. This prevents reproducible verification of the code loaded by `mcp-server.ts`. Because imported npm modules execute within the MCP server process, a compromised or unexpectedly changed dependency receives the same process access as the server. ### Attack Path 1. An attacker compromises a permitted release of `@modelcontextprotocol/sdk`, one of its transitive dependencies, a package maintainer, or the configured registry. 2. The compromised version remains compatible with the declared `^1.0.0` range. 3. A user follows the installation instruction and runs `npm install`. 4. Without a lockfile, npm resolves and installs the affected dependency tree. 5. The MCP server imports the installed package, causing attacker-controlled code to execute in the Agent process. ### Impact Assessment Exploitation can result in code execution with the MCP server user's privileges. Accessible assets include ...[truncated 321 chars]
• Remediation: ## Remediation Suggestions 1. Replace the caret dependency range with an exact, reviewed version. 2. Generate and commit `package-lock.json`. 3. Change installation guidance from `npm install` to `npm ci`. 4. Review and update dependencies through a controlled process that includes vulnerability scanning and source-change assessment. 5. Verify lockfile integrity in CI and reject unreviewed dependency-tree modifications. 6. Consider disabling dependency lifecycle scripts during installation when they are not required.

T09 · Insecure Skill Coding Practices

Warning

• Location: mcp-server.ts:17
• Finding: Bearer Credential Can Be Sent to an Untrusted or Plaintext API Endpoint## Vulnerability Details **File Location**: `mcp-server.ts`, line 17 and lines 91-110 **Vulnerability Type**: Insufficient destination and transport validation for sensitive network data **Risk Level**: Medium ### Vulnerable Code API endpoint selection at line 17: ```ts const API_URL = process.env.YUNDIAN_WOO_IMPORTER_API_URL || "http://localhost:3000"; // Note: Use the actual port where the app is running ``` Credential and import-data transmission at lines 91-101: ```ts const response = await fetch(`${API_URL}/api/v1/import`, { method: "POST", headers: { "Content-Type": "application/json", "Authorization": `Bearer ${API_KEY}` }, body: JSON.stringify(request.params.arguments) }); const data = await response.json(); return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] }; ``` Credential and request-ID transmission at lines 104-110: ```ts const { requestId } = request.params.arguments as any; const response = await fetch(`${API_URL}/api/v1/status?requestId=${requestId}`, { headers: { "Authorization": `Bearer ${API_KEY}` } }); const data = await response.json(); ``` ### Technical Analysis Supplying the API key to the Yundian+ service is necessary for the Skill's declared import functionality, and `SKILL.md` documents the intended endpoint as `https://ydplus.net`. However, the implementation trusts an arbitrary value from `YUNDIAN_WOO_IMPORTER_API_URL` and does not validate the URL scheme, hostname, port, or origin before attaching the Bearer credential. The fallback endpoint uses plaintext HTTP. Although loopback HTTP may be acceptable in a strictly local development configuration, the code does not verify that the resulting URL remains loopback-only. An unsafe or attacker-controlled environment value can therefore redirect the API key, submitted product links, Shopify or Wix store URLs, and status request IDs to another server. ### At ...[truncated 1430 chars]
• Remediation: ## Remediation Suggestions 1. Default to the documented production origin, `https://ydplus.net`, rather than plaintext HTTP. 2. Parse the configured value with `new URL()` and reject unsupported schemes. 3. Require HTTPS for all non-loopback destinations. 4. Enforce an explicit allowlist of approved API origins before attaching the Authorization header. 5. If local development is required, permit HTTP only when the parsed hostname is exactly a recognized loopback address such as `localhost`, `127.0.0.1`, or `::1`. 6. Reject URLs containing unexpected credentials, paths, query strings, fragments, or ports. 7. Apply short request timeouts and explicit redirect handling. Avoid forwarding credentials across redirects or origins. 8. Use narrowly scoped and revocable API keys, and rotate any key suspected of having been transmitted to an untrusted endpoint. 9. Document precisely what information is sent to Yundian+ and obtain user confirmation before transmitting sensitive or private source URLs.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill provisions executable components (`npx`, `tsx`, Node) and network/API access via environment-provided credentials, but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may invoke capability-bearing infrastructure without clear policy boundaries, increasing the chance of unintended code execution, secret exposure, or outbound requests beyond what a reviewer expects from the manifest alone.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill repeatedly instructs the agent to import products directly into WooCommerce, which is a state-changing operation affecting production store data, but it does not warn about destructive or business-impacting consequences or require confirmation. In an autonomous or semi-autonomous agent context, this can lead to accidental bulk imports, duplicate catalog entries, unwanted publication, or operational disruption from a casual user request.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "Yundian+ WooCommerce Importer Skill",
  "main": "mcp-server.ts",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0"
  }
}

• Confidence: 94% confidence
• Finding: The dependency is specified with a caret range (^1.0.0), which permits newer minor and patch releases to be installed without explicit review. This weakens build reproducibility and can unintentionally pull in a vulnerable or breaking version from the supply chain, especially significant for an MCP-facing skill that depends on protocol and transport behavior.

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The manifest references @modelcontextprotocol/sdk without pinning an exact version, and the package has known advisories including cross-client data leakage, ReDoS, and missing DNS rebinding protections in some releases. Because the actual installed version is not fixed, the skill may resolve to an affected release, creating avoidable exposure in a component that likely handles external tool/server communications.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: mcp-server.ts:17