百度地图地址·汽服门店销售攻店分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

The skill is mostly purpose-aligned, but it can send its API key to any endpoint set in an inherited environment variable.

Install only if you will set DDT_API_KEY in a controlled environment and ensure DDT_OPEN_BASE is unset or exactly the trusted service origin before use. Do not use production credentials with alternate endpoints unless you explicitly trust them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Configurable API Base URL Can Disclose the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–39 and 69–84
Vulnerability Type: Arbitrary authenticated endpoint configuration
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The request examples subsequently use the configurable base URL while attaching the API key:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The initialization expression preserves any preexisting DDT_OPEN_BASE environment variable without validating its URL scheme or destination host. The documented requests then attach Authorization: Bearer $DDT_API_KEY to URLs constructed from that value.

Consequently, an attacker who controls the inherited environment or execution configuration can redirect authenticated requests to an arbitrary endpoint. HTTPS alone does not prevent this issue because an attacker can operate a valid HTTPS server under a domain they control.

The vulnerability does not require shell-command injection: assigning a conventional attacker-controlled URL is sufficient to receive the authorization header when the documented request is executed.

Attack Path

1. The attacker gains influence over the Agent's process environment or launch configuration.
2. The attacker sets DDT_OPEN_BASE to an endpoint under their control, such as https://attacker.example.
3. The documented initializat ...[truncated 855 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the trusted HTTPS API origin when production credentials are attached.
2. If endpoint configuration is required, parse and validate the URL before each authenticated request:
   • Require the https scheme.
   • Require an exact allowlisted hostname.
   • Reject user-information components, unexpected ports, and ambiguous hostname forms.
   • Normalize the URL before comparison.
3. Do not preserve an inherited endpoint variable silently. Require an explicit, trusted configuration step for alternate environments.
4. Use separate credentials for development or staging endpoints; never send production credentials to configurable origins.
5. Prevent authorization headers from being forwarded to untrusted redirect destinations. Prefer disabling redirects or validating every redirect target against the same allowlist.
6. Apply least privilege, expiration, rotation, and usage monitoring to API keys.
7. Revoke and rotate any credential suspected of having been used while DDT_OPEN_BASE pointed to an untrusted host.

A safer fixed-origin example is:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep