Security audit

JD Price Protection 京东自动价保

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed JD.com price-protection automation, but users should understand it controls a logged-in browser and submits all matching requests automatically.

Install only if you want an agent to control your logged-in JD.com browser session and submit all visible price-protection requests. Prefer running it manually first, review the JSON output, and use scheduled silent mode only if you are comfortable with unattended account actions and local relay-token access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill performs browser automation against a logged-in JD.com session and explicitly derives authentication material from gateway configuration or environment variables, yet it declares no permissions or allowed-tools scope. That mismatch weakens user awareness and policy enforcement, making it easier for an agent to access sensitive local secrets and perform account actions without clear consent boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The scheduled usage instructs the agent to run account-affecting browser automation silently, suppressing notification on errors and on no-refund outcomes while still updating state. Silent recurring execution against a user account reduces transparency and can normalize unattended actions, making misuse or unexpected behavior harder for the user to detect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script silently reads a gateway authentication token from a local OpenClaw config file and uses it to derive a relay token for browser control. Even though this appears intended for convenience rather than theft, accessing credentials without clear disclosure or consent is security-sensitive because it enables authenticated control of a local browser relay and expands the blast radius if the skill is run unexpectedly or modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The automation enumerates and force-clicks all matching "申请价保" buttons, causing bulk account actions without an explicit confirmation step, dry run, or per-item review. In this skill's context, that is especially risky because it attaches to a live authenticated browser session on JD.com and can submit real account requests at scale, making accidental or abusive actions more consequential.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file requires interacting with JD.com-specific Chinese UI text such as "申请价保" and presents the skill as targeting a China-specific shopping workflow, but it does not explicitly state that the skill is limited to that locale or offer any language choice. This can violate language/locale policy when a skill forces a specific language experience without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.