高德地图地址·汽服门店销售攻店分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:48 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent automotive-service sales analysis API guide, but users should only send its bearer token to the trusted API host.

Install only if you intend to use 店店通's automotive-service API. Keep DDT_OPEN_BASE set to the official trusted HTTPS endpoint, protect and rotate DDT_API_KEY as you would any API credential, and avoid running the skill in shells or launchers where untrusted code can change environment variables.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:33

Finding

Unvalidated API Base URL Can Expose the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–37; affected request examples at lines 70–84
Vulnerability Type: Unvalidated authenticated API endpoint
Risk Level: High

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The resulting variable is used directly in authenticated requests:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The configuration preserves any pre-existing value of DDT_OPEN_BASE without validating its URL scheme or destination hostname. The documented requests subsequently attach the production bearer token to that configurable destination.

If an attacker can influence the Agent's process environment, deployment configuration, shell initialization, or wrapper responsible for invoking the Skill, the attacker can set DDT_OPEN_BASE to a server under their control. Following the Skill's documented workflow would then transmit the Authorization: Bearer $DDT_API_KEY header to the attacker-controlled endpoint.

The configuration also does not enforce HTTPS after an override. An http:// endpoint could expose the credential and query data to network interception in addition to the configured recipient.

Attack Path

1. The attacker gains the ability to influence the environment used to run the Skill, without needing direct access to the API key.
2. The attacker sets `DDT_OPEN_BAS ...[truncated 1167 chars]

Remediation

View remediation

Remediation Suggestions

1. Hardcode the trusted production API origin when attaching production credentials:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

2. If endpoint configurability is required, parse and validate the URL before making a request:

   • Require the https scheme.
   • Require an exact allowlisted hostname.
   • Reject embedded credentials, unexpected ports, fragments, and noncanonical host representations.
   • Avoid suffix-only hostname checks that could accept attacker-controlled domains.

3. Attach the Authorization header only after the destination has passed validation.

4. Separate development and production configuration. Development endpoints should use dedicated, least-privileged test credentials rather than production API keys.

5. Restrict who can modify the Agent's environment, launcher configuration, shell initialization files, and deployment manifests.

6. Configure short-lived, narrowly scoped credentials where supported, along with rate limits and rapid token revocation.

7. Avoid logging authorization headers and rotate the API key immediately if requests may already have been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep