单SKU门店分析

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill matches its retail analytics purpose, but it relies on an unaudited hard-coded local Python module and returns full raw backend API responses, which creates review-worthy security and data exposure risk.

Review before installing. Use this only in an environment where the external api_client path is controlled and audited, and where callers are authorized to see SKU sales, clerk performance, AIoT telemetry, and customer-segment analytics. The publisher should package or pin the API client inside the reviewed dependency chain and remove or gate raw_data before broad deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: analyze.py:31

Finding

Untrusted External Module Loading Through Search-Path Injection

Content

View full analysis

Vulnerability Details

File Location: analyze.py, lines 31-33
Vulnerability Type: Unsafe external dependency loading
Risk Level: High

Vulnerable Code

python

# 添加 API 客户端路径
sys.path.insert(0, '/Users/yangguangwei/.openclaw/workspace-front-door')
from api_client import get_copilot_data

Technical Analysis

The module prepends a hardcoded directory outside the audited Skill package to Python's module search path and then imports api_client from that location. Because the inserted path has the highest import precedence, an api_client.py file in that directory will be loaded instead of a reviewed or installed package.

The referenced module is not included in the project, so its implementation, integrity, version, and side effects cannot be audited. Python executes top-level module code during import, meaning that control over the referenced file is sufficient to execute arbitrary code merely by importing analyze.py.

This is also a deployment integrity problem: the path is tied to a particular developer account and may resolve differently, fail, or be populated with unrelated code on another system.

Attack Path

1. An attacker gains write access to /Users/yangguangwei/.openclaw/workspace-front-door, or compromises a process responsible for populating that directory.
2. The attacker creates or replaces api_client.py with malicious Python code.
3. A user or Agent loads the Skill, causing analyze.py to be imported.
4. Python searches the attacker-influenced directory first.
5. The malicious module's top-level code executes before the Skill performs any analysis.
6. The malicious module can also provide a spoofed get_copilot_data function to intercept parameters and API responses during later calls.

Impact Assessment

Successful exploitation provides arbitrary code execution with the same operating-system identity and privileges as the Agent process. Depending on that pr ...[truncated 589 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the sys.path.insert call and the user-specific absolute path.
2. Place the reviewed API client inside the Skill package and use an explicit package-relative import, such as:

   python

   from .api_client import get_copilot_data
   

3. If the client must be shared, distribute it through normal dependency management with an exact version pin and integrity verification.
4. Ensure dependency directories are not writable by untrusted users or lower-privileged processes.
5. Validate the client package's origin and include it in security reviews.
6. Avoid import-time side effects in the API client.
7. Run the Skill under a least-privileged account with access only to the credentials and data required for SKU analysis.

T09 · Insecure Skill Coding Practices

Warning

• Location: analyze.py:412

Finding

Division by Zero on Valid Zero-Sales Inventory Data

Content

View full analysis

Vulnerability Details

File Location: analyze.py, lines 412-418
Vulnerability Type: Unhandled arithmetic exception causing denial of service
Risk Level: Medium

Vulnerable Code

python

elif inventory > qty * 3:
    findings.append(Finding(
        title=f"库存积压（{inventory}件）",
        type="anomaly",
        metric="inventory",
        evidence=f"库存{inventory}件，约为本期销量的{inventory/qty:.1f}倍",
        confidence="medium",

Technical Analysis

The branch condition does not require qty to be positive. When the reporting period has zero sales and the SKU has positive inventory, inventory > qty * 3 evaluates to true because any positive inventory is greater than zero.

The evidence string then evaluates inventory / qty, which raises ZeroDivisionError when qty == 0. Zero period sales with remaining inventory is a legitimate and foreseeable retail state, so this failure does not require malformed input.

Although parse_metrics() safely represents this condition as an infinite turnover ratio, generate_findings() independently repeats the calculation without the same guard.

Attack Path

1. The upstream API returns a positive inventory value and qty equal to zero.
2. analyze() passes the parsed data to generate_findings().
3. The inventory checks skip the zero-inventory and low-inventory branches where applicable.
4. The condition inventory > qty * 3 evaluates to true.
5. Evaluation of the formatted evidence string performs inventory / 0.
6. Python raises ZeroDivisionError, and the analysis terminates without returning a completed result.

If API data or analysis parameters are attacker-influenced, an attacker can repeatedly select or induce zero-sales periods to trigger this failure.

Impact Assessment

The issue causes an availability failure within the analysis operation. It can prevent results from being generated for any SKU with positive stock and n ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

Handle zero sales as a separate state before calculating an inventory-to-sales ratio:

python

elif qty == 0 and inventory > 0:
    findings.append(Finding(
        title=f"Inventory has no period sales ({inventory} units)",
        type="anomaly",
        metric="inventory",
        evidence=f"Current inventory is {inventory} units, with no sales during the period",
        confidence="high",
        implication="Review demand, merchandising, and inventory allocation"
    ))
elif qty > 0 and inventory > qty * 3:
    ratio = inventory / qty
    # Generate the backlog finding using ratio.

In addition:

1. Centralize ratio calculation so all functions use the guarded value from parse_metrics().
2. Validate that inventory and quantity are numeric and non-negative.
3. Add unit tests for zero sales, zero inventory, missing values, negative values, and unusually large numbers.
4. Add a controlled exception boundary around analysis generation so one malformed record cannot terminate a larger batch.

T09 · Insecure Skill Coding Practices

Warning

• Location: analyze.py:144

Finding

Undocumented Disclosure of Complete Upstream API Responses

Content

View full analysis

Vulnerability Details

File Location: analyze.py, lines 144-147
Vulnerability Type: Excessive data exposure through unrestricted raw response return
Risk Level: Medium

Vulnerable Code

python

'raw_data': {
    'goods': goods,
    'performance': performance_data
}

Technical Analysis

The Skill returns complete upstream API objects under raw_data in addition to its normalized output. This field is absent from the output structure documented in SKILL.md, and the implementation applies no field allowlist or redaction before returning the responses.

The performance API processes employee-performance and customer-distribution information. Returning the entire response allows any current or future undocumented fields from that API to propagate to callers, logs, orchestration layers, or downstream Agents even when those fields are unnecessary for SKU analysis.

This violates data-minimization and stable-interface principles. The exposure can expand silently if the upstream API later adds identifiers, operational metadata, or other sensitive fields.

Attack Path

1. The upstream goods or performance API returns fields beyond those required for normalized analysis.
2. analyze() stores the complete goods and performance_data objects in raw_data.
3. The result is returned to the calling Agent or application.
4. The caller may serialize, log, retain, or forward the complete result based on the documented expectation that it contains only analysis fields.
5. Undocumented data becomes available to downstream components or users that were intended to receive only derived metrics.

No direct network exfiltration is implemented in the audited files. Exploitation or exposure depends on sensitive fields being present in the upstream response and the returned object reaching a less-trusted consumer.

Impact Assessment

The issue can expose all fields available in the two API responses ...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove raw_data from the standard result and return only documented, normalized fields.
2. If raw responses are needed for diagnostics, require an explicit privileged debug option that defaults to disabled.
3. Apply a strict field allowlist before exposing any diagnostic data.
4. Redact employee identifiers, customer-related fields, credentials, tokens, internal metadata, and other sensitive values.
5. Update SKILL.md to accurately document every returned field and its sensitivity.
6. Prevent raw diagnostic objects from being written to production logs.
7. Apply role-based authorization and short retention periods to any system that stores debug responses.
8. Add tests that fail when undocumented upstream fields appear in the public result.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are broad enough that ordinary product-performance questions could invoke this skill without clear user intent or sufficient scoping. In this skill’s context, unintended invocation can expose store/SKU sales, inventory, clerk contribution, and AIoT metrics more often than necessary, increasing the chance of oversharing sensitive business analytics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language descriptions, field explanations, and user-facing output strings throughout the file force Chinese as the interaction language. The policy requires avoiding a fixed language or locale unless the user is given a choice or the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The result includes a raw_data object containing full backend goods and performance responses, which likely exposes undeclared internal fields and customer-adjacent telemetry beyond the skill's analysis output. Returning raw upstream payloads breaks least-privilege and data-minimization, and can leak sensitive business or customer-related data to downstream consumers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill parses and returns new-vs-old VIP purchase distribution, which is customer-segmentation data not clearly required by the stated single-SKU/store analysis purpose. Even if aggregated, exposing extra customer-related attributes increases unnecessary data processing and can violate data-minimization expectations or internal access boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description and trigger instructions are presented entirely in Chinese, which can amount to forcing a specific language without user opt-in. The file does not indicate that the skill is region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code inserts a specific local filesystem path into sys.path and then imports an API client from that location. This changes runtime behavior and accesses local code/resources, but there is no user-facing warning beyond a terse internal comment, so users may not realize the skill depends on a developer-local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.