汽服门店销售攻店专家

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

This is a coherent API-integration skill for automotive-service sales research, but users should keep its API endpoint pinned to the trusted service before sending their API key.

Before using the skill, set DDT_OPEN_BASE only to the intended trusted API origin or leave it at the documented default, keep DDT_API_KEY out of chats/logs/repos, and rotate the key if it may have been used with an untrusted endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Bearer API Key Can Be Sent to an Untrusted Configurable Endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–28 and 69–86
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

The Skill permits DDT_OPEN_BASE to be inherited from the execution environment and subsequently sends DDT_API_KEY to that endpoint as a bearer token.

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The configurable value is then used as the destination for authenticated requests:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The default API endpoint is legitimate-looking, but the shell expansion preserves any preexisting DDT_OPEN_BASE value without validating its URL scheme or hostname. The documented curl commands attach the bearer credential to whichever server the variable identifies.

This creates a credential-exfiltration sink when the Skill is executed in an environment whose variables can be influenced by another user, a wrapper script, compromised automation, or an untrusted configuration file. The flaw does not require command injection: an attacker only needs to substitute an HTTPS endpoint under their control.

Attack Path

1. An attacker gains the ability to influence the environment or configuration used to invoke the Skill.
2. The attacker sets DDT_OPEN_BASE to an endpoint they control, such as `htt ...[truncated 995 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin authenticated requests to the expected service origin instead of inheriting an arbitrary base URL:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required, validate the parsed URL before attaching credentials. Require HTTPS, the exact approved hostname, and the expected path prefix. Reject user-info components, alternate ports unless explicitly approved, and deceptive subdomains.

3. Restrict the protocol used by curl and prevent accidental protocol downgrades:

   bash

   curl --proto '=https' --fail --silent --show-error -G \
     -H "Authorization: Bearer $DDT_API_KEY" \
     "https://gotoshop-ai.com/ddtclaw/v1/auto-service/brand/profile"
   

4. Do not forward the Authorization header across hosts. If redirects are enabled in future examples, ensure credentials cannot be propagated to a different origin.

5. Store the API key in a protected secret manager or tightly permissioned environment rather than general-purpose configuration files. Use a narrowly scoped, short-lived credential where supported.

6. Rotate the key immediately if commands may have been executed with an untrusted DDT_OPEN_BASE, and review API access logs for unknown destinations, abnormal quota use, or unauthorized requests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep