高德地图地址·零售连锁门店网络分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent retail analysis helper that uses a disclosed external API, but users should ensure the API base URL is trusted before sending their API key.

Install only if you trust the publisher and the DDT API service. Set DDT_API_KEY only in a trusted environment, leave DDT_OPEN_BASE unset unless you intentionally need a custom endpoint, and verify it points to the expected HTTPS service before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Unvalidated API Base URL Can Expose the Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–34 and 66–82
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

The Skill permits the API origin to be overridden through the existing DDT_OPEN_BASE environment variable. It then includes DDT_API_KEY as a bearer credential in requests sent to that origin.

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

Each request is instructed to include the bearer credential:

text

Each request includes `Authorization: Bearer $DDT_API_KEY`.

The vulnerable request pattern is demonstrated throughout the examples:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The default endpoint uses HTTPS and points to the expected service. However, the shell expansion preserves any previously defined DDT_OPEN_BASE value without validating its scheme, hostname, port, path, or ownership.

Because the same variable determines the destination of requests carrying the Authorization header, a malicious or compromised runtime configuration can redirect the bearer credential to an attacker-controlled endpoint. This is a credential exfiltration weakness caused by coupling a configurable destination with an automatically attached secret.

The issue does not require command injection: a syntactically valid attacker-controlled URL is sufficient. HTTPS alone does not prevent the attack because ...[truncated 1372 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the endpoint override if custom API origins are not operationally necessary:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

2. If overrides are required, validate the parsed destination before attaching credentials:

   • Require the https scheme.
   • Allow only explicitly approved hostnames.
   • Reject embedded user information, unexpected ports, fragments, and malformed URLs.
   • Avoid suffix-based hostname validation that could accept domains such as gotoshop-ai.com.attacker.example.

3. Attach the Authorization header only after confirming that the final request origin is allowlisted.

4. Do not forward credentials across redirects. Reject cross-origin redirects and avoid options that preserve authorization headers when the destination changes.

5. Add a startup check that fails closed when DDT_OPEN_BASE differs from an approved endpoint.

6. Document that endpoint configuration must come only from trusted deployment configuration and must not be derived from user input.

7. Rotate DDT_API_KEY immediately if requests may already have been sent to an untrusted origin, and review service logs for unauthorized use or unusual quota consumption.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep