Taobao Draft Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

The skill does not auto-publish or show data theft, but it falsely marks listings as compliant without doing the promised checks and has local file-scope issues that need review.

Install only if you treat all generated drafts and audit sheets as unverified templates. Do not rely on the pass marks for compliance, material consistency, prohibited words, pricing, inventory, or category correctness. Use a controlled product ID format, keep inputs in a dedicated working directory, review outputs manually before any Taobao publication, and pin or lock dependencies before operational use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/draft_generator.py:65
• Finding: Compliance Checks Are Unconditionally Reported as Passed## Vulnerability Details **File Location**: `scripts/draft_generator.py`, lines 65-75 and 102-120 **Vulnerability Type**: Fail-open validation and fabricated compliance results **Risk Level**: High ### Vulnerable Code ```python draft = { '款号': product_id, '标题': product_info.get('title', ''), '类目': product_info.get('category', ''), '属性': product_info.get('attributes', {}), '价格': product_info.get('price', {}), '库存': product_info.get('stock', 100), '图片': product_info.get('images', []), '详情页': product_info.get('detail', ''), '合规校验': '✅ 通过', '生成时间': datetime.now().strftime('%Y-%m-%d %H:%M:%S') } ``` ```python def _generate_audit_report(self, draft: Dict, product_dir: Path) -> str: """生成终审表""" import pandas as pd audit_dir = product_dir / 'audit' audit_dir.mkdir(parents=True, exist_ok=True) # 创建简单的审计表 data = { '检查项': ['标题合规性', '五维材质一致性', '违禁词检测', '类目正确性', '属性完整性', '价格合规性', '库存合规性'], '状态': ['✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过'], '备注': ['', '', '', '', '', '', ''] } df = pd.DataFrame(data) audit_path = audit_dir / 'audit_report.xlsx' with pd.ExcelWriter(audit_path, engine='openpyxl') as writer: df.to_excel(writer, sheet_name='上架信息终审表', index=False) return str(audit_path) ``` ### Technical Analysis The implementation copies untrusted product data directly into the draft and then assigns an unconditional successful compliance status. The audit report similarly marks title compliance, material consistency, prohibited-word detection, category correctness, attribute completeness, price compliance, and inventory compliance as passed without executing any corresponding validation. This contradicts the documented fail-closed controls, including five-dimensional material consistency checks, minimum price and inventory thresholds, prohibited-word detection, and ...[truncated 1424 chars]
• Remediation: ## Remediation Suggestions 1. Implement each advertised check as an explicit validation function with deterministic pass, fail, and error states. 2. Validate the input against a strict schema before generating any output. 3. Compare normalized material information across the title, attributes, detail page, tag data, and quality report. 4. Maintain and enforce a reviewed prohibited-word policy. 5. Validate category membership and required attributes against authoritative category metadata. 6. Enforce the documented price, discount, SKU price, and inventory limits. 7. Load the configuration file and reject startup if mandatory controls are disabled or malformed. 8. Fail closed when required evidence is missing or a validator encounters an error. 9. Include the evidence, evaluated value, rule identifier, and failure reason for every audit row. 10. Never use a successful status as a default value. Generate an overall pass only after every mandatory check succeeds. 11. Add automated negative tests covering missing fields, inconsistent materials, prohibited words, invalid prices, and low inventory.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/draft_generator.py:53
• Finding: User-Controlled Product ID Is Used in Filesystem Paths Without Containment Validation## Vulnerability Details **File Location**: `scripts/draft_generator.py`, lines 53-62, 79-88, and 102-120 **Vulnerability Type**: Path traversal and unintended file access **Risk Level**: Medium ### Vulnerable Code ```python # 从本地文件夹读取人工编辑的素材 product_dir = Path(f'./products/{product_id}') if not product_dir.exists(): raise Exception(f"商品文件夹不存在：{product_dir}") info_file = product_dir / 'product_info.json' if not info_file.exists(): raise Exception(f"商品信息文件不存在：{info_file}") with open(info_file, 'r', encoding='utf-8') as f: product_info = json.load(f) ``` ```python # 保存草稿 draft_dir = Path('./drafts') draft_dir.mkdir(parents=True, exist_ok=True) draft_path = draft_dir / f"draft_{product_id}.json" with open(draft_path, 'w', encoding='utf-8') as f: json.dump(draft, f, ensure_ascii=False, indent=2) # 生成终审表（简化版） audit_report_path = self._generate_audit_report(draft, product_dir) ``` ```python audit_dir = product_dir / 'audit' audit_dir.mkdir(parents=True, exist_ok=True) audit_path = audit_dir / 'audit_report.xlsx' with pd.ExcelWriter(audit_path, engine='openpyxl') as writer: df.to_excel(writer, sheet_name='上架信息终审表', index=False) ``` ### Technical Analysis The command-line product ID is directly interpolated into input and output paths. There is no character allowlist, rejection of path separators, canonical path resolution, or verification that the resolved path remains under the intended `products` or `drafts` directory. Traversal components such as `..` can therefore influence the resolved product directory. If a reachable external directory contains a file named `product_info.json`, the application can read that file as product data. The same derived directory is used to create an `audit` subdirectory and write `audit_report.xlsx`. The draft filename is also derived from the product ID. Path separators can influence its destination, although successful redirection ...[truncated 1598 chars]
• Remediation: ## Remediation Suggestions 1. Restrict product IDs to a narrow allowlist, such as `^[A-Za-z0-9_-]{1,64}$`. 2. Reject absolute paths, path separators, drive prefixes, null bytes, and `.` or `..` components. 3. Construct paths from fixed base directories and canonicalize them with `Path.resolve()`. 4. Verify containment before every read or write, for example by requiring the resolved target to be relative to the resolved base directory. 5. Generate output filenames from a validated identifier rather than raw user input. 6. Open output files using exclusive creation where overwriting is not intended. 7. Consider storing audits in a fixed application-owned audit directory instead of below an input-derived directory. 8. Add tests for traversal payloads, absolute paths, Windows drive paths, UNC paths, mixed separators, and encoded separators.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/draft_generator.py:58
• Finding: Unbounded and Unvalidated JSON Input Can Exhaust Resources or Produce Malformed Drafts## Vulnerability Details **File Location**: `scripts/draft_generator.py`, lines 58-75 **Vulnerability Type**: Unbounded input processing and missing schema validation **Risk Level**: Low ### Vulnerable Code ```python info_file = product_dir / 'product_info.json' if not info_file.exists(): raise Exception(f"商品信息文件不存在：{info_file}") with open(info_file, 'r', encoding='utf-8') as f: product_info = json.load(f) # 生成草稿 draft = { '款号': product_id, '标题': product_info.get('title', ''), '类目': product_info.get('category', ''), '属性': product_info.get('attributes', {}), '价格': product_info.get('price', {}), '库存': product_info.get('stock', 100), '图片': product_info.get('images', []), '详情页': product_info.get('detail', ''), '合规校验': '✅ 通过', '生成时间': datetime.now().strftime('%Y-%m-%d %H:%M:%S') } ``` ### Technical Analysis `json.load()` parses the entire file into memory without checking its size. The resulting value is assumed to be a dictionary, and selected fields are accepted without type, range, length, nesting-depth, or item-count restrictions. A sufficiently large file can consume excessive memory and CPU during parsing and serialization. Unexpected root types can trigger exceptions when `.get()` is called, while oversized strings or arrays can produce very large draft files. Invalid numeric and structural values also flow into output without validation. ### Attack Path 1. An attacker or untrusted local operator places an oversized or deeply nested `product_info.json` in a product directory. 2. Draft generation loads the entire document into process memory. 3. Parsing and subsequent serialization consume excessive memory, CPU, or disk space. 4. The process may terminate, become unresponsive, or create an oversized draft. 5. Alternatively, a valid JSON root with an unexpected type causes generation to fail when dictionary methods are used. ### Impact As ...[truncated 403 chars]
• Remediation: ## Remediation Suggestions 1. Check the file size before parsing and reject files above a documented limit. 2. Require the JSON root to be an object. 3. Validate input with a strict schema that defines required fields, permitted types, numeric ranges, maximum string lengths, maximum list lengths, and allowed properties. 4. Limit title, detail, image, attribute, and price data to business-appropriate sizes. 5. Reject non-finite numbers and unexpected nested structures. 6. Set an output-size budget and stop generation if the normalized draft exceeds it. 7. Return specific validation errors without generating a successful audit report. 8. Add tests using oversized files, deeply nested documents, large arrays, invalid root types, and malformed numeric values.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:5
• Finding: Dependencies Use Open-Ended Version Ranges Without Integrity Pinning## Vulnerability Details **File Location**: `requirements.txt`, lines 5-16 **Vulnerability Type**: Non-reproducible and insufficiently constrained dependency installation **Risk Level**: Low ### Vulnerable Code ```text # HTTP 请求 requests>=2.31.0 # 数据处理 pandas>=2.0.0 openpyxl>=3.1.0 # 环境变量加载 python-dotenv>=1.0.0 # 日志 colorlog>=6.7.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended lower bound. Future releases and their transitive dependencies can therefore be installed without review, making installations non-reproducible. No hashes are supplied to verify package artifacts. The implementation does not use `requests` or `colorlog`, so those packages add unnecessary dependency and transitive supply-chain surface. The audit did not identify a confirmed malicious package, typosquatted name, or unsafe external package index; the risk is the absence of reproducible version and integrity controls. ### Attack Path 1. A user follows the documentation and runs `pip install -r requirements.txt`. 2. The resolver selects the newest releases satisfying the open-ended constraints. 3. Those versions may differ from the versions reviewed or tested by the project author. 4. Installation executes package build or installation behavior and imports the resulting components during later execution. 5. A compromised future release, compromised transitive dependency, or incompatible update can affect the host or application. ### Impact Assessment Dependency installation normally runs with the privileges of the invoking Python environment. A compromised dependency could therefore execute code with those privileges during installation or runtime. No such compromise is demonstrated in the reviewed package, so this finding represents supply-chain exposure rather than confirmed malicious execution. The scope includes the ...[truncated 111 chars]
• Remediation: ## Remediation Suggestions 1. Remove unused dependencies, particularly `requests` and `colorlog`, unless functionality requiring them is implemented. 2. Pin all direct and transitive dependencies to reviewed versions through a lock file. 3. Generate and enforce cryptographic hashes, such as with `pip --require-hashes`. 4. Install only from a trusted package index over authenticated TLS. 5. Use an isolated virtual environment with least privilege. 6. Run dependency vulnerability and license scanning in continuous integration. 7. Establish a controlled update process that tests and reviews dependency changes before modifying the lock file. 8. Avoid running package installation as an administrator or other privileged account.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件
notepad .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件
notepad .env
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件
notepad .env
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims strong compliance controls, including SEO title rewriting, five-dimensional material consistency checks, and pre-publication compliance review, but the finding indicates these controls are not actually implemented and may be statically marked as passed. This creates a false sense of safety: operators may trust the generated draft and audit sheet, allowing non-compliant, misleading, or policy-violating listings to proceed to manual publication.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The code claims to perform five-dimensional material consistency checks and SEO title rewriting, but it only copies fields from product_info and hard-codes compliance as passed. In this commerce listing context, operators may rely on the draft and audit output as evidence of review, causing non-compliant, misleading, or policy-violating product listings to be published after a false sense of safety.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The draft embeds '合规校验: ✅ 通过' without performing any real compliance validation. In a listing-generation workflow, this can directly misrepresent unverified data as approved, increasing the chance of policy violations, false advertising, or unsafe product information reaching manual publishers who trust the generated artifact.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The generated audit spreadsheet marks multiple review checks as passed using fixed values, regardless of product data. This creates falsified audit artifacts that can be mistaken for genuine review evidence, undermining manual controls in a marketplace compliance process where the stated purpose is safe draft preparation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The documented trigger phrase is very broad and overlaps with ordinary conversational language, which can cause the skill to activate unintentionally during normal discussion. In an agent environment, accidental invocation may lead to unintended processing of local product materials or generation of commercial drafts without the user explicitly intending to run the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises safety and constrained behavior, but it does not declare any explicit tool scope despite requiring capabilities consistent with environment access and file read/write. Without an allowlist or permissions declaration, an agent runtime may grant broader-than-necessary access, increasing the chance of unintended file or secret exposure if the implementation is changed or misused.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This code file contains user-facing docstrings, CLI descriptions, help text, and console output entirely in Chinese, including the required command flags and operational warnings. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module documentation states that the tool operates only through official APIs, but the implementation performs only local file reads and writes. This mismatch can mislead users, reviewers, and downstream controls about the trust boundary and actual behavior of the tool, weakening governance and review processes.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: 整个 README 的标题、步骤、调用示例、参数名和输出字段均默认要求使用中文，没有说明是否支持其他语言，也没有提供用户选择语言/区域的方式。按规则，强制单一语言而无用户显式选择，属于自然语言层面的语言/locale 策略风险。

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The file contains natural-language text in Chinese and references a Taobao listing-draft skill, implying a fixed language/locale context. Because no opt-in or choice is presented in the file, this may reflect a language/locale constraint that is not explicitly justified here.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 版本：1.0.0

# HTTP 请求
requests>=2.31.0

# 数据处理
pandas>=2.0.0

• Confidence: 93% confidence
• Finding: Using requests>=2.31.0 allows dependency resolution to select any later version, which makes builds non-reproducible and can unintentionally introduce vulnerable or incompatible releases. In a supply-chain context, this weakens assurance that deployments consistently use a reviewed, known-safe version.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: The manifest does not pin requests, so it is impossible to verify from this file whether the installed version avoids known advisories. In a skill that likely performs HTTP requests to external services, uncertainty around a network-facing library increases the chance of credential leakage, TLS-related issues, or other client-side security weaknesses if an affected release is resolved.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

# 数据处理
pandas>=2.0.0
openpyxl>=3.1.0

# 环境变量加载

• Confidence: 92% confidence
• Finding: Using pandas>=2.0.0 leaves the installed version open-ended, so different environments may pull different releases with different security and behavior characteristics. This increases supply-chain risk and makes it harder to verify whether the deployed version is affected by known issues.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: Because pandas is not pinned, the manifest cannot demonstrate whether the deployed version is affected by known advisories. The risk is somewhat contextual and often depends on unsafe deserialization or untrusted data handling elsewhere, but the uncertainty is still a supply-chain security concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas>=2.0.0
openpyxl>=3.1.0

# 环境变量加载
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: Using openpyxl>=3.1.0 permits any newer version, reducing reproducibility and preventing clear verification against known vulnerable releases. Because spreadsheet parsers often process untrusted files, unclear version control can increase risk if a bad release is introduced.

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The openpyxl version is not pinned, so this manifest cannot prove that XML-related historical vulnerabilities are avoided. Given the skill's likely spreadsheet-processing use case, ambiguity around the parser version is more dangerous because attacker-controlled workbook content may be involved.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.1.0

# 环境变量加载
python-dotenv>=1.0.0

# 日志
colorlog>=6.7.0

• Confidence: 91% confidence
• Finding: Using python-dotenv>=1.0.0 allows unconstrained future versions, making the environment setup dependent on whatever release the installer resolves at build time. Since this package can influence configuration loading and file handling, unreviewed upgrades can introduce avoidable security or operational risk.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: Without version pinning, the manifest cannot establish whether python-dotenv resolves to a release affected by known file-handling issues. Since dotenv libraries can read from or write to local configuration files, an affected version could contribute to file overwrite or configuration tampering risks in certain workflows.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0

# 日志
colorlog>=6.7.0

• Confidence: 88% confidence
• Finding: Using colorlog>=6.7.0 creates the same reproducibility and supply-chain exposure as other unpinned dependencies, though the direct security impact is lower for a logging helper. Still, unreviewed upgrades can cause unexpected behavior or pull in vulnerable transitive dependencies.

Static analysis

No suspicious patterns detected.