TKSeller

• Outcome: Review
• Latest audit: Jul 8, 2026 · 3:06 AM UTC
• Version: 3.3.13

Overview

TKSeller appears to be a real commerce automation skill, but it asks for account passwords in chat and uses broad background, credential, device-tracking, and Discord permissions without enough containment or disclosure.

Review before installing. Do not use this in shared chat channels, and do not enter real account passwords unless you trust the publisher and backend. Require HTTPS, a safer auth flow, explicit token storage/deletion behavior, clear opt-in and stop controls for polling, limited Discord guild registration, and disclosure or removal of hardware-derived device tracking before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill directs the agent to call a local gateway API to add and remove cron jobs, extending its behavior beyond simple TKSeller request handling into host-level orchestration. This creates persistent background execution and a new control surface that could be abused for unintended repeated actions, especially because the skill also pushes the model to execute immediately and suppress normal user-facing safeguards.

Context-Inappropriate Capability

Low

• Confidence: 75% confidence
• Finding: The webchat mode adds download-and-store behavior for external images into a local data directory, which is broader than the stated recommendation workflow and introduces unnecessary file-write capability. Even if intended for rendering product cards, downloading attacker-controlled URLs can create storage abuse, unexpected persistence, or later misuse of untrusted content.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code derives a persistent device fingerprint from BIOS UUID, machine-id, and MAC address, then hashes and transmits it during login. This exceeds what a normal API client typically needs and creates durable cross-session tracking tied to hardware, which is privacy-sensitive and difficult for users to rotate or revoke.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This helper module imports subprocess primitives (`execSync`, `spawn`) and later uses them to launch and kill local processes, which exceeds a narrow card-rendering role and increases the blast radius of the skill. In an agent skill, process-control capability is dangerous because any misuse or future bug can terminate unrelated local processes or execute unexpected local programs.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module reads `~/.openclaw/openclaw.json` and extracts the gateway auth token plus channel configuration from the user's home directory. Accessing local credentials inside a skill is sensitive because it grants the skill ambient authority over the user's messaging integrations and could be repurposed to enumerate or misuse connected accounts.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code can kill existing local processes, delete PID/lock files, and remove cron jobs via the gateway, giving it destructive control over host execution state. Even if intended for singleton polling, this capability can be abused or mis-triggered to disrupt service availability or interfere with other scheduled automation.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: The skill downloads arbitrary remote media and then invokes a local Python interpreter with Pillow to transform that content. Processing attacker-controlled files with local parsers expands the attack surface to SSRF, resource exhaustion, malformed-file parser bugs, and unsafe dependency execution on the host.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This script performs bot-administrative actions by discovering the application ID, enumerating every guild the bot belongs to, and registering a slash command across all of them. That behavior exceeds the stated skill purpose of TKSeller account/login/usage automation and creates a wider operational footprint than a user would reasonably expect, making unauthorized command deployment possible anywhere the token has access.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code lists all Discord guilds available to the bot and mass-registers commands into each one, which is an unnecessary privilege expansion for the described TKSeller functionality. In a skill context, this can propagate functionality broadly across unrelated servers, increasing blast radius if the bot token is misused or the skill behavior is not understood by the operator.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill reads local Discord configuration and silently launches a child process to register Discord commands, even though the primary advertised function is seller login/recommendation. This expands the skill's authority into local environment inspection and side-effectful cross-system modification without explicit user consent, which is risky in an agent skill because it can alter external integrations unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The trigger performs channel discovery, channel mutation, connectivity probing, auto-registration, and poll recovery across Discord/webchat contexts, which goes beyond a narrowly scoped seller workflow. In an agent environment, this kind of cross-channel orchestration increases the blast radius of a simple message trigger and can cause unintended outbound communication or state changes in channels the user did not mean to touch.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The README advertises a very broad natural-language trigger (the plain text phrase “带货”) that can cause the skill to activate unintentionally in ordinary conversation. In a skill that later solicits credentials and initiates workflow actions through chat, accidental activation increases the chance of unwanted prompts, user confusion, or social-engineering-style credential capture.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The README explicitly instructs users to send `登录 用户名 密码` in chat and says the login will be automatically saved, with no warning about secure handling, storage, or visibility of credentials. This creates a direct credential collection path through a messaging channel, where secrets may be exposed to bots, logs, channel members, screenshots, or downstream integrations.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger rules include broad, common terms like equivalents of 'start', 'recommend', and the skill name, and instruct the model to route uncertain messages to the skill anyway. This makes accidental invocation likely, which is dangerous here because activation can immediately launch exec flows, registration, login handling, and background polling without a precise user request.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The webchat examples normalize vague standalone words as valid commands, increasing the chance that ordinary conversation text will invoke the skill. In this skill's context, unintended activation is more risky because the instructions emphasize immediate tool execution and external side effects.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill asks users to provide usernames and passwords in chat and stores tokens locally, but it does not provide a clear warning about credential handling, storage, retention, or exposure risks. This is especially dangerous because the instructions also insist that the agent suppress normal explanatory responses, reducing informed consent and making users more likely to share secrets unsafely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sets up persistent polling and automatic outbound messaging but does not clearly warn users that background activity and external notifications will continue after the initial command. This undermines user consent and can lead to surprise network activity, repeated tool execution, and messages being sent to connected channels without an obvious ongoing prompt.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The access token is persisted in plaintext JSON on disk under the skill directory without any visible protection, expiry handling, or user notice. If the local filesystem is accessed by another user, process, backup system, or malware, the bearer token can be stolen and reused to impersonate the account.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill collects a hardware-derived device identifier from BIOS UUID, machine-id, and MAC address and sends it to the server as device_id during authentication, with no indication of user consent or disclosure in this code. Because these identifiers are stable and hard to change, they enable long-term tracking and device binding beyond normal login needs.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code path supports forceful termination/replacement of poll processes without any user-facing notice or confirmation in the module. In an agent context, silently killing background work is risky because it removes operator awareness and can interrupt expected local tasks or conceal disruptive behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file reads a gateway authentication token from a local credential store without any user-facing disclosure in this code. Silent use of ambient credentials is dangerous in agent skills because it hides the extent of privilege being exercised and can enable unauthorized messaging or session operations if the skill is compromised.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The code forwards raw error text into an external message via ct.sendText(msg), and the error may contain sensitive internal details, upstream service responses, identifiers, or stack fragments. If error content is attacker-influenced or comes from internal systems, this can cause unintended data disclosure to all recipients of the review channel.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code accesses `~/.openclaw/openclaw.json` to inspect Discord tokens and then silently attempts command registration, with no user-facing disclosure in this file. Secret-bearing configuration should not be read for unrelated side effects without transparency, because users may not expect a seller skill to inspect local messaging credentials or modify Discord application state.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This is a true credential-harvesting pattern: the skill documentation normalizes entering account credentials directly into natural-language chat. In the context of a Discord/webchat-integrated automation skill, that is especially dangerous because chat platforms commonly retain message history and may expose content to operators, logs, other users, or compromised integrations.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill instructs the model to treat any follow-up after a login prompt as a login command, causing subsequent user messages to be interpreted as credentials and forwarded automatically. This can capture unintended secrets or misroute unrelated text, and the surrounding rules discourage clarification or confirmation before execution.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.install_untrusted_source, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/api.mjs:85

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/card-tools.mjs:441

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: lib-js/trigger.mjs:235

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:4

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: lib-js/api.mjs:51