百度地图地址·汽车后市场渠道洞察

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but its setup can send the API key to an environment-selected server if DDT_OPEN_BASE is already set.

Install only in a controlled shell environment. Before using a real key, clear or explicitly set DDT_OPEN_BASE to the intended https://gotoshop-ai.com/ddtclaw endpoint, avoid untrusted launchers or shell profiles, and rotate the key if it may have been used with an unexpected endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

Environment-Controlled API Endpoint Can Exfiltrate the API Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–37 and 67–81
Vulnerability Type: Configurable credential destination without scheme or hostname validation
Risk Level: High

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

text

Each request includes `Authorization: Bearer $DDT_API_KEY`.

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The documented initialization only assigns the legitimate service URL when DDT_OPEN_BASE is unset. Any value already present in the process environment is preserved. The subsequent commands attach DDT_API_KEY as a bearer credential to requests constructed from that unvalidated value.

The instructions do not verify that the destination uses HTTPS or that its hostname is exactly gotoshop-ai.com. Consequently, an attacker who can influence the runtime environment can redirect authenticated requests to an attacker-controlled endpoint. Quoting the variable prevents shell command injection, but it does not prevent credential disclosure to an unauthorized destination.

Attack Path

1. An attacker, compromised launcher, malicious shell profile, or untrusted automation environment sets DDT_OPEN_BASE to an attacker-controlled URL.
2. The operator follows the documented initialization command.
3. Bec ...[truncated 991 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not permit an inherited environment variable to determine the destination of authenticated requests. Use a fixed trusted base URL:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint overrides are operationally necessary, validate them before sending credentials. Require HTTPS, reject embedded user information, and allowlist the exact expected hostname and path.
3. Configure curl to permit HTTPS only:

   bash

   curl --proto '=https' --fail --silent --show-error -G \
     -H "Authorization: Bearer $DDT_API_KEY" \
     "https://gotoshop-ai.com/ddtclaw/v1/auto-service/brand/profile" \
     --data-urlencode "brand=中鑫之宝"
   

4. Avoid forwarding credentials across redirects. Do not use --location-trusted; if redirects are enabled, validate the final destination and ensure credentials cannot cross origins.
5. Run the Skill in a controlled environment that clears untrusted inherited proxy and endpoint variables.
6. Rotate any API key that may have been used while DDT_OPEN_BASE pointed to an untrusted destination, and review API usage logs for unauthorized activity.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep