ClawHub
Back to skill

Security audit

sycm-shop-report

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to generate Chinese Taobao/Tmall business reports from a user's own SYCM data and write local report files, with no evidence of hidden credential access, exfiltration, or destructive behavior.

Install only if you need Chinese Taobao/Tmall SYCM merchant reports. Use a dedicated output directory because the scripts can overwrite same-named PNG and docx files, and enable the optional scheduled-job setup only if recurring access to store metrics is intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents a full report-generation skill for Taobao/Tmall merchants that uses SYCM connector data and outputs Chinese .docx reports. The actual code chunk is explicitly labeled as step 2 of a pipeline and is limited to rendering daily charts from an existing JSON file. This is a materially narrower and different behavior than the declared end-to-end skill purpose. While chart generation is related to the declared reporting workflow, the code shown neither performs data retrieval from 生意参谋 nor creates the final Word report, and it only covers the daily case. Therefore the supplied code chunk does not accurately represent the declared skill behavior on its own.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The description presents a full report-generation skill centered on retrieving Taobao/Tmall merchant data from the SYCM MCP connector and producing Chinese daily/weekly/monthly reports from that source. The actual code chunk is much narrower: it is only step 3 of a pipeline, assembling a日报 .docx from already-prepared local data and chart images. The code explicitly states it does not fetch network resources, call MCP, generate charts, or upload data. That is a material description/behavior mismatch because the core declared capability is data retrieval from SYCM via MCP, while the code only performs local document rendering for a daily report. The mainland-China/Taobao-oriented content and Chinese output are consistent, but the primary purpose and resource access described are broader and different from the behavior shown.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
NODE_PATH="<全局 node_modules>" node scripts/build_daily_report.js # 或 build_weekly_report.js

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
- **只读**：从 `taobao-open-platform` MCP 拉店铺经营指标（无客户 PII、无订单收货信息、无凭证）。
- **只写**：用户指定的 `output_dir` 下的 PNG 与 docx，不写其他路径。
- **不外发**：不 fetch URL、不上传、不远程执行代码；`npm i -g` / `pip install` 只在首次环境自检时按 references 提示建议用户手动执行。
- **凭证**：MCP 授权与 access token 由千问办公连接器层管理，本技能代码不接触。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code file contains natural-language documentation entirely in Chinese, including the usage/help description, which effectively constrains operation to a specific language. Under the policy, language-specific behavior should either offer user choice or clearly justify the locale restriction; no such opt-in or justification appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The header states the script produces a Chinese .docx report, and the rest of the file hardcodes Chinese report titles and labels. This is a natural-language locale policy issue because the skill forces a specific language without offering a user choice or documenting a justified regional-only constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstrings are entirely in Chinese, including usage guidance, and the generated chart labels and final console output are also Chinese-facing throughout the file. This imposes a specific language/locale on users without any opt-in or indication that the skill is intentionally limited to a Chinese-language regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file states it produces a Chinese .docx report and the report content throughout the script is fixed in Chinese. This enforces a specific language/locale choice without offering the user an option to select another language or documenting a region-specific policy need within the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This manifest-style JSON uses Chinese natural-language instructions and descriptions throughout, starting with the top-level note, but does not offer any language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking context. That can violate the language/locale policy for skills that should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This JSON example contains natural-language report text and instructions exclusively in Chinese, and the file does not state that Chinese is optional or that the skill is limited to a Chinese-speaking or region-specific context. Under the language/locale policy rule, forcing a single language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.