高德地图地址·汽车后市场渠道洞察

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but it sends a bearer API key to a configurable API base URL, which users should review before installing.

Install only if you trust the DDT service and your runtime environment. Before using a real DDT_API_KEY, pin DDT_OPEN_BASE to the official endpoint or ensure it has not been overridden, and avoid running the skill from wrappers or environments you do not control.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

User-Overridable API Base URL Can Expose the Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–38 and 78–91
Vulnerability Type: Unvalidated API endpoint override leading to credential disclosure
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

text

Each request carries `Authorization: Bearer $DDT_API_KEY`.

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The configuration preserves any pre-existing DDT_OPEN_BASE value without validating its scheme, hostname, port, or path. The documented requests subsequently attach Authorization: Bearer $DDT_API_KEY to URLs derived from that variable.

Consequently, an attacker who controls the process environment or an untrusted launcher can set DDT_OPEN_BASE to an attacker-operated endpoint. When an agent follows the documented invocation flow, it sends the bearer credential and request parameters to that endpoint. Requiring HTTPS alone would not prevent this issue because an attacker can operate a valid HTTPS server.

Attack Path

1. An attacker, compromised wrapper, or untrusted execution environment defines DDT_OPEN_BASE=https://attacker.example.
2. The documented assignment retains that value because the variable is already set.
3. A user or agent supplies DDT_API_KEY and invokes one of the documented API requests.
4. The request is constructed using the attacker-contro ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the production API origin instead of inheriting an arbitrary environment value:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

2. If endpoint overrides are required for testing, place them behind an explicit development mode and validate the parsed URL before sending credentials:

   • Require the https scheme.
   • Require an exact allowlisted hostname.
   • Reject user-information components, unexpected ports, fragments, and malformed paths.
   • Keep production and development credentials separate.

3. Configure curl to permit HTTPS only:

bash

curl --proto '=https' --fail --silent --show-error ...

4. Reject unexpected redirects and never forward the Authorization header to a different origin. Keep redirects disabled unless they are strictly necessary and their destinations are validated.

5. Validate the destination immediately before every authenticated request rather than relying solely on initialization-time checks.

6. Rotate any API key that may have been used while DDT_OPEN_BASE was controlled by an untrusted environment, and review API usage logs for anomalous requests.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The output requirements are written as mandatory instructions for how responses should be produced, and they require Chinese phrasing and presentation without any opt-in or alternative locale. This can violate language/locale policy when users may expect responses in their own language or the session language.

Content

No source excerpt is available for this finding.