ClawHub
Back to skill

Security audit

Digikala

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Digikala seller API helper that can affect a live seller account when given a token, with the main sensitive behaviors documented and user-directed.

Install this only if you intend to let an agent use your Digikala seller API token. Prefer a least-scoped token, review uploads and title/product changes before running them, treat save-product, assign, and brand-request as live account actions, and protect or rotate the token if you use ~/.digikala/token.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (43)

Credential Access

High
Category
Privilege Escalation
Content
- GET  `/auth/scopes` - List all defined scopes
- GET  `/auth/scopes/{client_code}` - List scopes available for your application
- POST `/auth/token` - Generate access and refresh token (requires authorization_code)
- POST `/auth/refresh-token` - Generate new access token using refresh token
- POST `/auth/revoke` - Revoke seller access token (requires self_settings scope)

## Category (1)
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- GET  `/auth/scopes` - List all defined scopes
- GET  `/auth/scopes/{client_code}` - List scopes available for your application
- POST `/auth/token` - Generate access and refresh token (requires authorization_code)
- POST `/auth/refresh-token` - Generate new access token using refresh token
- POST `/auth/revoke` - Revoke seller access token (requires self_settings scope)

## Category (1)
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
openapi: 3.0.0
info:
    title: 'DK Marketplace - Open API Service'
    description: "This project is an <b>enhancement of the Digikala Marketplace API</b>. Its main goal is providing an API-based solution for Developers useful for implementing new Applications To improve Digikala Sellers Business. <br>To use these APIs, you must have an <b>'Active Client'</b> registered in Digikala. If you don't, You can use the <b>[Sandbox](https://github.com/salimousavi/seller_service_sandbox)</b> (with Mock Data) to develop your Application. <br>For More Information (Client Registration, Issues, Bugs and suggestions), please contact us.\n### API count: 274"
    version: 1.0.0
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
/open-api/v1/auth/scopes: { get: { tags: ['Authentication (5)'], summary: '', description: 'List of <b>Scopes</b>.<br>This API shows all scopes that are defined in this service and can be used, but it does <b>NOT</b> mean it is available for your application.<br>If you don''t have a scope and your application need it, contact the support team for it', parameters: [{ in: header, name: content-type, required: true, schema: { default: application/json } }], requestBody: null, responses: { 200: { description: ScopeListView, content: { application/json: { schema: { type: object, properties: { status: { type: string, description: 'request status', example: ok }, data: { type: object, description: 'data of request', properties: { sort_data: { type: object, description: 'data about sorting things', properties: { sort_column: { type: string, description: 'name of sort column', example: id }, sort_order: { type: string, description: 'acs or desc', example: asc }, sort_columns: { type: array, description: 'name of sort columns', example: [id] } } }, pager: { type: object, description: 'data about pager things', properties: { page: { type: integer, description: 'page number', example: 1 }, item_per_page: { type: integer, description: 'number of item per page', example: 50 }, total_pages: { type: integer, description: 'number of total pages' }, total_rows: { type: integer, description: 'number of total rows' } } }, form_data: { type: array, items: {  } }, items: { type: array, description: 'items of view', items: { type: object, properties: { key: { type: string, description: 'scope identification key. use this in seller redirection to digikala for getting access', example: variant }, title: { type: string, description: 'The scope title in Persian', example: 'مدیریت تنوع و قیمت‌گذاری' }, description: { type: string, description: 'The scope definition in persian', example: 'امکان مشاهده و ویرایش اطلاعات مدیریت تنوع و قیمت‌گذاری پنل شما را خواهد داشت' }, access: { type: string, de
...[truncated 27 chars]
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium
Category
Rogue Agent
Content
## Overview

This skill enables seamless interaction with Digikala's seller API for:
- **Product Management** - Full product creation pipeline (search → validate → create → assign)
- **Category Navigation** - Tree browsing, keyword search, validation
- **Image Handling** - Upload to temp storage, AI quality checks
- **Order, Shipment, Finance, Customer Service** - Additional endpoints documented in references
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium
Category
Agent Snooping
Content
### Option 3: Manual Install (Claude Code)
```bash
mkdir -p ~/.claude/skills/digikala
# Copy SKILL.md, scripts/, and references/ directories
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Option B: Token file (recommended for persistence)
   mkdir -p ~/.digikala
   echo "your_access_token_here" > ~/.digikala/token
   chmod 600 ~/.digikala/token
   ```
4. **Start Using the API**:
   ```bash
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Option B: Token file (recommended for persistence)
   mkdir -p ~/.digikala
   echo "your_access_token_here" > ~/.digikala/token
   chmod 600 ~/.digikala/token
   ```
4. **Start Using the API**:
   ```bash
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Option B: Token file (recommended for persistence)
   mkdir -p ~/.digikala
   echo "your_access_token_here" > ~/.digikala/token
   chmod 600 ~/.digikala/token
   ```
4. **Start Using the API**:
   ```bash
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium
Category
Rogue Agent
Content
A[Search Products] --> B{Found?}
    B -->|Yes| C[Validate Category]
    B -->|No| D[Request New Brand]
    C --> E[Create Draft + Validate Details]
    E --> F[Upload Images]
    F --> G[AI Image Check]
    G --> H[Save Title]
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- **Never commit tokens to version control** (add `~/.digikala/token` to `.gitignore`)
- Rotate tokens periodically via Digikala seller panel
- Tokens expire — renew before expiration
- **Security**: The token file should be `chmod 600` (owner read/write only)

## API Reference
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- **Never commit tokens to version control** (add `~/.digikala/token` to `.gitignore`)
- Rotate tokens periodically via Digikala seller panel
- Tokens expire — renew before expiration
- **Security**: The token file should be `chmod 600` (owner read/write only)

## API Reference
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
local auth_header=$(get_auth_header)
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" \
            -H "Content-Type: $content_type" \
            -H "$auth_header" \
            -d "$data" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
local auth_header=$(get_auth_header)
    
    if [[ -n "$data" ]]; then
        curl -s -X "$method" \
            -H "Content-Type: $content_type" \
            -H "$auth_header" \
            -d "$data" \
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
echo "  search <keyword>          - Search categories by keyword" >&2
        echo "  validate <category_id>    - Validate category for product creation" >&2
        echo "" >&2
        echo "Authentication: Set DIGIKALA_ACCESS_TOKEN env var or create ~/.digikala/token file" >&2
        exit 1
        ;;
esac
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium
Category
Rogue Agent
Content
echo "  search <keyword>          - Search categories by keyword" >&2
        echo "  validate <category_id>    - Validate category for product creation" >&2
        echo "" >&2
        echo "Authentication: Set DIGIKALA_ACCESS_TOKEN env var or create ~/.digikala/token file" >&2
        exit 1
        ;;
esac
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.