Taobao Operations

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:02 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a Taobao operations helper, but it reports business, compliance, customer-service, and after-sales success from hard-coded demo data instead of real checks or platform actions.

Review this carefully before installing. Do not rely on its reports or success messages for real store compliance, inventory, risk, customer-service, or refund decisions unless the hard-coded demo behavior is replaced with verified Taobao API integrations, clear failure handling, and explicit human approval gates. Install dependencies only in an isolated environment and pin them if used.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/operations_main.py:56
• Finding: Fabricated Operational, Compliance, and Security Results## Vulnerability Details **File Location**: `scripts/operations_main.py:56-65`, `scripts/operations_main.py:92-105`, `scripts/operations_main.py:135-141`, `scripts/operations_main.py:195-217`, `scripts/operations_main.py:222-238`, and `scripts/operations_main.py:254-261` **Vulnerability Type**: Misleading hard-coded results and unconditional success reporting **Risk Level**: High ### Vulnerable Code ```python # Create daily report data (sample data) data = { '核心指标': ['总销售额', '订单数', '客单价', '转化率', 'ROI'], '今日数值': ['15,000 元', '120', '125 元', '3.5%', '2.5'], '昨日数值': ['12,000 元', '100', '120 元', '3.2%', '2.3'], '环比': ['+25%', '+20%', '+4.2%', '+0.3%', '+8.7%'], '异常标注': ['✅', '✅', '✅', '✅', '✅'] } ``` ```python # Create compliance inspection report (sample data) data = { '商品 ID': ['1001', '1002', '1003'], '商品名称': ['春秋夹克', '休闲裤', 'T 恤'], '违禁词检测': ['✅ 通过', '✅ 通过', '✅ 通过'], '属性完整性': ['✅ 完整', '⚠️ 缺失面料', '✅ 完整'], '材质一致性': ['✅ 一致', '✅ 一致', '✅ 一致'], '价格合理性': ['✅ 合理', '✅ 合理', '✅ 合理'], '库存状态': ['✅ 充足', '⚠️ 不足 10 件', '✅ 充足'], '风险等级': ['低', '中', '低'], '修改建议': ['', '建议补充面料信息', ''] } ``` ```python # Create inventory synchronization report (sample data) data = { '库存类型': ['淘宝库存', '网商园现货', '差异'], '数量': ['100 件', '80 件', '-20 件'], '状态': ['✅', '⚠️ 低于安全库存', '⚠️ 需补货'], '建议': ['', '', '建议补货 50 件'] } ``` ```python def start_cs_auto_reply(self): """Start automatic customer-service replies in the background.""" logger.info("启动客服自动回复（后台运行）") print("💬 正在启动智能客服自动回复...") print() print("✅ 客服自动回复已启动！") print() print("⚠️ 重要提示：") print(" 1. 客服回复开头固定话术：") print(" 「您好，当前为智能客服服务，复杂问题将为您转接人工客服~」") print(" 2. 仅 3 类低风险售后自动处理：") print(" - 未发货仅退款") print(" - 已发货未签收拦截成功退款") print(" - 50 元以内无纠纷小额退款") print(" 3. 其余售后 100% 转人工处理") print(" ...[truncated 3844 chars]
• Remediation: ## Remediation Suggestions 1. Disable operational commands until their underlying platform integrations are implemented. 2. Clearly and prominently label all hard-coded output as demonstration data in terminal output, filenames, worksheets, and documentation. 3. Retrieve sales, inventory, product, order, and security information from authoritative, read-only Taobao API endpoints. 4. Validate API responses, account identity, response timestamps, pagination, and data completeness before producing reports. 5. Fail closed when credentials are missing, API requests fail, or required data is incomplete. Never substitute a normal or successful result. 6. Report after-sales completion only after receiving and validating a successful platform response for the specified order. 7. Report customer-service activation only after a real worker or service has started successfully and passed a health check. 8. Include data provenance, collection time, account/store identifier, query status, and explicit uncertainty indicators in every report. 9. Add integration tests using mocked API responses for success, authentication failure, timeout, partial data, and platform rejection scenarios. 10. Update `README.md`, `SKILL.md`, and the import report so that documented capabilities accurately match implemented behavior.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:5
• Finding: Unpinned Dependencies Permit Unreviewed Package Versions## Vulnerability Details **File Location**: `requirements.txt:5-16` and `README.md:6-10` **Vulnerability Type**: Open-ended third-party dependency resolution without integrity verification **Risk Level**: Low ### Vulnerable Code ```text # HTTP requests requests>=2.31.0 # Data processing pandas>=2.0.0 openpyxl>=3.1.0 # Environment variable loading python-dotenv>=1.0.0 # Logging colorlog>=6.7.0 ``` The documented installation procedure executes dependency installation directly: ```bash cd C:\Users\Administrator\.openclaw\workspace\skills\taobao-operations pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. Consequently, installation may resolve to future package versions that were not available or reviewed when the Skill was published. No lock file, package hashes, approved index configuration, or integrity constraints are provided. Python package installation and runtime imports can execute package-controlled code. If an upstream package account, release process, distribution artifact, or package-index channel is compromised, a later package version satisfying the minimum constraint can be installed automatically. The audit found no evidence that the currently named dependencies are malicious. The risk arises from non-reproducible resolution and lack of integrity controls rather than from a confirmed malicious package. ### Attack Path 1. An attacker compromises an upstream dependency release process, package maintainer account, or distribution channel. 2. The attacker publishes a malicious version whose number satisfies the corresponding `>=` constraint. 3. A user follows the documented `pip install -r requirements.txt` procedure. 4. Package resolution selects the compromised release because no exact version or hash is required. 5. Malicious code executes during installation or when the affected package ...[truncated 868 chars]
• Remediation: ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version. 2. Generate and commit a lock file that includes all transitive dependencies. 3. Require cryptographic hashes during installation, such as through a hash-locked requirements file and `pip --require-hashes`. 4. Install packages only from an explicitly approved package index using HTTPS. 5. Perform dependency vulnerability and provenance scanning in continuous integration. 6. Review and test dependency upgrades before updating pinned versions. 7. Use an isolated virtual environment and avoid running package installation with administrative privileges. 8. Remove unused dependencies to reduce supply-chain exposure; for example, confirm whether `requests` and `colorlog` are necessary because the reviewed script does not use them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件（如使用淘宝 API）
notepad .env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件（如使用淘宝 API）
notepad .env
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 复制环境变量模板
copy .env.example .env

# 编辑 .env 文件（如使用淘宝 API）
notepad .env
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description repeatedly claims read-only, non-modifying, human-confirmed behavior, but the documented commands include automatic customer-service replies and after-sales auto-processing. This mismatch is dangerous because users and policy engines may trust the safer description while the actual behavior can perform externally visible actions, creating risk of unauthorized responses, business logic changes, or compliance violations.

Intent-Code Divergence

High

• Confidence: 93% confidence
• Finding: The file claims that all operations require human confirmation, yet it exposes auto-reply and auto after-sales handling modes. Even though this sample implementation only prints messages, the interface and stated behavior normalize autonomous customer-facing and refund-related actions, which could mislead operators and, in a fuller implementation, cause unauthorized business actions or compliance issues.

Intent-Code Divergence

High

• Confidence: 92% confidence
• Finding: The CLI is presented as 'only generating suggestions', but it includes commands to start automated customer-service behavior and auto-process after-sales requests. In an operational skill, this kind of capability mismatch can cause unsafe trust assumptions by users or reviewers and can enable unintended autonomous handling of customer interactions or refunds once connected to real backends.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The skill documentation is entirely written in Chinese and the invocation examples use Chinese command parameters such as '日期' and '全店'. There is no indication that users may choose another language or that the Chinese-only requirement is region-specific and intentional, which creates a natural-language locale policy concern.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill exposes code-capable behavior without declaring an explicit tool scope or permissions boundary. Even though the markdown claims read-only, the absence of formal restrictions means the runtime may still access environment-derived secrets or broader capabilities than intended, weakening least-privilege controls.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The claim of '100% compliant' and 'zero violation risk' is an absolute safety guarantee that cannot be justified from the skill content alone. Such language can mislead operators into lowering scrutiny, approving broader access, or relying on automation in regulated customer-service and after-sales contexts where mistakes can directly create platform compliance exposure.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This manifest/config file uses Chinese-only natural-language labels, comments, and condition values throughout, which effectively forces a specific language for operators and downstream users. The file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-language or region-specific deployment.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The module docstring and all user-facing descriptions are written as Chinese-only operational instructions, and the file does not provide any language selection, opt-in, or justification that this skill is restricted to a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without user choice is a natural-language locale violation.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest description frames the skill as read-only and non-modifying, but the code creates a logs directory and writes to operations.log. Additional commands also create reports and export XLSX files, which are state-changing write operations rather than purely read-only behavior.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The module docstring says '仅读 API 数据' and '不自动修改任何信息', which implies a read-only operational posture. However, functions such as generate_daily_report save XLSX files under ./reports, and similar write behavior appears in compliance, inventory, task, and risk report generation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The document makes strong safety assurances such as 'read-only' and 'does not auto-modify,' yet elsewhere states that customer-service auto-replies and three categories of after-sales cases are handled automatically. This inconsistency can mislead operators and reviewers about the skill’s actual behavior, increasing the chance that automation is enabled or trusted in situations where human review was expected.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The '不自动修改/仅生成建议' claim directly conflicts with statements that some after-sales handling is automatic. Contradictory safety documentation is dangerous because users may rely on the less risky description and deploy the skill without appropriate oversight, potentially causing unauthorized customer communications or workflow actions.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The natural-language comments describe the skill entirely in Chinese and frame it as a combined operations/customer-service/compliance skill without indicating that language choice is optional. Under the policy rule, forcing a specific language or locale without opt-in can be a violation when no justification or alternative is provided.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 版本：1.0.0

# HTTP 请求
requests>=2.31.0

# 数据处理
pandas>=2.0.0

• Confidence: 93% confidence
• Finding: Using requests>=2.31.0 leaves dependency resolution open to future releases, making builds non-reproducible and preventing verification that a safe version is consistently installed. In a skill that performs HTTP requests and may handle customer-service or operational data, this increases supply-chain and regression risk if a vulnerable or incompatible release is pulled.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests has multiple known advisories, and because the manifest does not pin a version, it is impossible to verify from this file whether deployments avoid affected releases. Given this skill's stated use of APIs and customer/operations workflows, an affected HTTP client version could expose credentials, TLS/session handling, or request metadata in real-world use.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0

# 数据处理
pandas>=2.0.0
openpyxl>=3.1.0

# 环境变量加载

• Confidence: 90% confidence
• Finding: pandas>=2.0.0 is unpinned, so installations may resolve to different versions over time, reducing reproducibility and making it difficult to guarantee that known-vulnerable releases are excluded. While this file alone does not show unsafe deserialization, data-processing libraries are high-value supply-chain dependencies and should be controlled.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: A known advisory exists for pandas, and the lack of pinning means this manifest cannot prove whether a safe release is used. The danger is contextual and lower here because the file does not show unsafe pickle/deserialization usage, but dependency uncertainty remains a valid supply-chain concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
pandas>=2.0.0
openpyxl>=3.1.0

# 环境变量加载
python-dotenv>=1.0.0

• Confidence: 91% confidence
• Finding: openpyxl>=3.1.0 permits any newer release, which weakens reproducibility and makes it unclear whether future installed versions remain free from parsing-related issues. Because spreadsheet libraries often process untrusted files in operations/customer-support workflows, uncontrolled upgrades can increase the risk of parser or file-handling vulnerabilities impacting the environment.

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: openpyxl has historical XXE-related advisories, and without a pinned version the manifest cannot demonstrate that deployments are on a non-affected release. In an operations/support skill that may read spreadsheets from external parties, this context makes parser-related dependency risk more relevant than a purely internal-only tool.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.1.0

# 环境变量加载
python-dotenv>=1.0.0

# 日志
colorlog>=6.7.0

• Confidence: 88% confidence
• Finding: python-dotenv>=1.0.0 allows unreviewed future versions to be installed, creating supply-chain uncertainty and making it hard to verify that deployment uses a safe release. Environment-loading libraries influence configuration and secrets handling, so version drift can have security consequences even if no direct exploit is shown in this file.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 76% confidence
• Finding: python-dotenv has listed advisories, and the unpinned specification prevents verification that installed versions are unaffected. The risk is somewhat limited by the file alone, but because this library touches environment/configuration material, uncertainty around version safety is still undesirable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0

# 日志
colorlog>=6.7.0

• Confidence: 84% confidence
• Finding: colorlog>=6.7.0 is an unpinned dependency, which creates nondeterministic builds and minor supply-chain exposure. The direct security impact is lower than for network or file-processing libraries, but exact pinning is still a best practice for integrity and reproducibility.

Static analysis

No suspicious patterns detected.