ClawHub
Back to skill

Security audit

淘宝竞品分析选品雷达 · 新品卖点拆解

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent ecommerce research skill, but it needs Review because scraped browser-session data can be sent to an LLM endpoint controlled by an environment variable.

Review before installing. Use it only with a trusted local browser relay and trusted local LLM pipeline, unset or strictly control WC3_LLM_ENDPOINT, and choose an output directory that is not synced or shared if scraped reviews/comments are sensitive. Expect it to use your logged-in Chrome Taobao/Tmall session for browsing and to save raw/derived analysis files locally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill forwards scraped product metadata, buyer review text, XHS comments, and locally downloaded images to an LLM subprocess for tagging, demand extraction, and conclusions, but there is no explicit runtime disclosure or consent for that secondary processing. Even if the subprocess is described as local, the trust boundary changes materially because sensitive scraped content is being handed to another component that may itself proxy to external services, log prompts, or retain outputs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly performs browser-driven collection against logged-in Taobao/Tmall and xhs sessions, calls local HTTP services, and runs Node code, yet it declares no explicit tool scope or permissions boundary. That mismatch is dangerous because it obscures the real capabilities of the skill, preventing meaningful user consent and making overbroad data access or local execution harder to audit.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger language is broad enough to activate on generic ecommerce-analysis or product-selection requests, increasing the chance the skill runs when the user did not specifically intend browser scraping and session-backed collection. In this context, accidental invocation is more dangerous because the skill accesses logged-in marketplace sessions and gathers comments and product data across multiple sites.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The user-facing description emphasizes convenience and 'no API key' usage but does not clearly foreground that the skill will operate through the user's logged-in Taobao/Tmall browser session and browse xhs content to collect data. This is risky because users may unknowingly authorize access to authenticated session data and third-party browsing context without informed consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.mjs (reported line 806)May include surrounding context.

js
P('<table><tr><th>#</th><th>商品ID</th><th>卡片标题</th><th>店铺</th><th>卡片销量</th><th>选取情况</th></tr>');
  (selection.top5 || []).forEach((c, i) => {
    const hit = (selection.picks || []).find((p) => p.index === i && !p.error);
    const skipList = (selection.skips || []).filter((s) => s.index === i);
    const skipTxt = skipList.map((s) => `${s.label ? s.label + ':' : ''}顺延跳过（${s.reason}）`).join('；');
    let mark = '未选';
    if (hit && skipTxt) mark = skipTxt + '；后选为 ' + hit.label + '（随机数 ' + Number(hit.randomValue).toFixed(4) + '）';

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.mjs (reported line 807)May include surrounding context.

js
P('<table><tr><th>#</th><th>商品ID</th><th>卡片标题</th><th>店铺</th><th>卡片销量</th><th>选取情况</th></tr>');
  (selection.top5 || []).forEach((c, i) => {
    const hit = (selection.picks || []).find((p) => p.index === i && !p.error);
    const skipList = (selection.skips || []).filter((s) => s.index === i);
    const skipTxt = skipList.map((s) => `${s.label ? s.label + ':' : ''}顺延跳过（${s.reason}）`).join('；');
    let mark = '未选';
    if (hit && skipTxt) mark = skipTxt + '；后选为 ' + hit.label + '（随机数 ' + Number(hit.randomValue).toFixed(4) + '）';

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill persistently writes scraped reviews, shop data, selection history, classification results, and a full HTML report to disk under the output directory without any explicit consent, minimization, retention control, or redaction. Because this includes user-generated review text and derived analysis artifacts, it creates a local privacy and data-handling risk if the workstation, shared directory, or downstream tooling is compromised or synced elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments explicitly claim that routing through local HTTP eliminates environment-hijack risk, yet the implementation still trusts a host-controlled environment variable to select the endpoint. That mismatch is dangerous because developers and reviewers may assume the boundary is stronger than it is, while an attacker controlling the host environment can silently reroute all LLM requests to an attacker-controlled service.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The tool documents a security boundary of only calling a local daemonized LLM service, but it still lets the destination be overridden by the inherited WC3_LLM_ENDPOINT environment variable. In a hostile or untrusted host environment, that allows prompt contents and possibly schema/session data to be redirected to an arbitrary local or remote server, defeating the intended isolation and enabling data exfiltration or SSRF-like behavior.

Content

No source excerpt is available for this finding.