PDD Shopping Assistant

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:21 PM UTC
• Version: 2.2.0

Overview

This shopping skill is mostly disclosed but needs review because it advertises a no-login boundary while its workflow can use a logged-in Pinduoduo account, change cart/group-buy state, enter checkout preview, and expose address data.

Install only if you are comfortable with an agent potentially using an already logged-in Pinduoduo session, changing cart or group-buy state, applying coupons, and seeing checkout-preview details. Keep use to public browsing/product evaluation unless you give explicit action-by-action consent, and do not let it proceed into checkout or handle address, order submission, or payment screens.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/browser-workflow.md:55
• Finding: Authenticated account access and state-changing commerce actions exceed the declared read-only scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-36`, `SKILL.md:76-80`, `SKILL.md:292-296`, and `references/browser-workflow.md:55-80` **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium The package description declares a safety boundary of “no login, no order submission, no payment,” but the operational workflow instructs the Agent to reuse an authenticated session, modify shopping-account state, enter checkout, and extract the user's delivery address. ### Vulnerable Code Snippets The declared boundary in `SKILL.md:1-4` is: ```yaml --- name: pdd-shopping description: "Pinduoduo shopping assistant. Input a product name or PDD link; evaluate 百亿补贴, 拼团 rules, seller risk, visible price, review signals, refund caveats, and whether the low price is worth it. Safe boundary: no login, no order submission, no payment." --- ``` The capability table in `SKILL.md:32-36` nevertheless permits authenticated, state-changing operations: ```markdown | **Add to Cart** | ✅ Required | Add items to shopping cart | | **View Cart** | ✅ Required | Review cart contents | | **Join Group Buy** | ✅ Required | Initiate or join 拼团 | | **Apply Coupons** | ✅ Required | Check and apply platform/seller coupons | | **Generate Order Preview** | ✅ Required | Calculate final price with subsidies | ``` The workflow in `SKILL.md:76-80` directs the Agent to perform these actions: ```markdown ### Phase 3: Cart & Pre-Order (Agent-Assisted with Login) 1. **Add to Cart** - Agent adds item to cart (requires login) 2. **Group Buy Action** - Initiate or join 拼团 (requires login) 3. **Cart Review** - Agent shows cart contents 4. **Coupon Application** - Agent checks platform + seller coupons 5. **Order Summary** - Agent generates complete order preview ``` The execution guide in `SKILL.md:292-296` further instructs the Agent to alter account state: ```markdown Step 5: Order Generation (Requires login) - Add to cart - Initiate or join ...[truncated 3606 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the default workflow strictly read-only and restrict it to public product, seller, price, review, and service-guarantee pages. 2. Remove instructions that add products to the cart, initiate or join group purchases, apply account coupons, or enter checkout. 3. Remove `.delivery-address` from all extraction rules. Price calculations should collect only item identifiers, discounts, fees, and totals that do not expose personal information. 4. If authenticated functionality is intentionally retained, update `SKILL.md`, `package.json`, and `clawhub.json` so their descriptions explicitly disclose authenticated access and state-changing operations. 5. Require separate, action-specific confirmation immediately before every account mutation rather than relying on a single general login confirmation. 6. Stop before opening checkout. Present manual instructions so the user can review the cart, delivery address, coupons, order submission, and payment independently. 7. Add runtime checks that reject selectors or actions associated with checkout, final confirmation, order submission, payment, addresses, credentials, SMS codes, CAPTCHA responses, and identity verification. 8. Minimize snapshots and logs so that account-specific personal information cannot be retained accidentally. 9. Add tests verifying that public evaluation requests never access an authenticated profile or invoke cart, group-buy, checkout, or address selectors. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The manifest claims a safe boundary of 'no order submission, no payment,' but the body permits state-changing commerce actions including add-to-cart, initiating or joining 拼团, applying coupons, and generating order previews. On PDD, joining or initiating a group buy may create commitments or advance the transaction flow, so the top-level safety claim understates the real capability and can mislead orchestration layers or users.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented supported operations include Add to Cart, View Cart, Initiate/Join Group, Apply Coupons, and Generate Order Preview, which go beyond the skill's declared evaluation-only boundary of 'no login, no order submission, no payment.' This creates a capability mismatch that could lead an agent to perform transactional or account-scoped actions the user did not expect, increasing the risk of unauthorized commerce actions and privacy exposure.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The workflow explicitly instructs login-dependent actions such as clicking add-to-cart, initiating or joining a group, navigating to the cart, and proceeding to checkout for an order preview, despite the manifest stating a 'no login' safety boundary. In an agent setting, this contradiction is dangerous because implementation often follows the more detailed workflow, enabling account-affecting actions and movement toward purchase completion.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Common Traps

- **Joining any group without checking seller** → Quality varies wildly
- **Ignoring shipping times** → Can be 5-10 days
- **Assuming 百亿补贴 = always authentic** → Still verify seller
- **Not reading 1-star reviews** → Pattern of issues

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill defines 'When login is required (ask first)' as a stop condition, but elsewhere explicitly authorizes proceeding with logged-in actions such as viewing carts, joining groups, and applying coupons after consent. This contradiction can cause an agent to misinterpret safety boundaries and continue into authenticated commerce flows that materially change the user's account state.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- ❌ Recommend sellers with rating <4.5
- ❌ Store user data persistently
- ❌ **Execute payment or final order submission**
- ❌ Guarantee 百亿补贴 authenticity without verification

## Related Skills

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: Claiming 'clear safety boundaries' while the same document includes contradictory transactional and login-required flows is a misleading safety assertion. This is not just wording drift: it can reduce operator vigilance and cause downstream agents or reviewers to trust the skill more than warranted, making the boundary violations elsewhere more likely to be executed.

Static analysis

No suspicious patterns detected.