百度地图地址·零售渠道与竞对分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned, but its documented setup can send the user's bearer API key to an unintended endpoint if DDT_OPEN_BASE is pre-set.

Review before installing. Use this only in a controlled environment, explicitly set DDT_OPEN_BASE to the official HTTPS service origin, and do not run the sample curl commands if that variable may have been inherited from an untrusted shell or automation context.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

Configurable API Base URL Can Expose the Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–38 and 72–76
Vulnerability Type: Unvalidated credential destination
Risk Level: High

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

The same credential-bearing request pattern is also used by the other documented API examples through line 89.

Technical Analysis

DDT_OPEN_BASE retains any value already present in the execution environment. The instructions do not validate its URL scheme, hostname, port, or origin before using it in requests that attach DDT_API_KEY as a bearer token.

Consequently, a preconfigured or poisoned environment can change DDT_OPEN_BASE to an attacker-controlled endpoint. Following the documented request flow then transmits the authorization header and query parameters to that endpoint. The endpoint can also return fabricated API responses that may be treated as retail-analysis data.

Allowing an HTTP URL would additionally expose the bearer token and submitted data to network interception because the instructions do not enforce HTTPS.

Attack Path

1. An attacker or compromised environment configuration defines DDT_OPEN_BASE as an attacker-controlled URL, such as https://attacker.example.
2. The user follows the documented initialization command.
3. Because the shell expansion only applies the legitimate URL when the variable is unset or empty, the malicious value remains active.
4. The user or agent executes one of the documented curl requests.
5. curl sends Authorization: Bearer $DDT_API_KEY and the request parameters to the attacker-controlled server.
6. The attacker captures the API key and submitted brand or location d ...[truncated 753 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the trusted HTTPS origin when sending the authorization header:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required for approved testing environments, validate the parsed URL before making requests:

   • Require the https scheme.
   • Require an explicit allowlisted hostname.
   • Reject embedded credentials, unexpected ports, fragments, and malformed URLs.
   • Resolve the destination only after validation.

3. Do not attach Authorization to requests whose origin differs from the approved API origin.

4. Keep cross-origin redirects disabled. If redirects are later enabled, ensure the authorization header is stripped whenever the scheme, hostname, or port changes.

5. Separate production and testing credentials. Use narrowly scoped, short-lived keys for non-production endpoints.

6. Add a preflight check that terminates with an error when DDT_OPEN_BASE is set to an unapproved value, rather than silently trusting an inherited environment variable.

7. Rotate any API credential that may already have been used while the base URL pointed to an untrusted destination.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep