腾讯地图地址·汽车后市场渠道洞察

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:48 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent automotive channel-analysis helper that calls a disclosed DDT API with user-provided credentials, with one endpoint-configuration hardening note.

Install only if you are comfortable using a DDT API key and sending the relevant brand, location, and store-query data to the DDT service. Keep the API key out of chats, logs, and repositories, and use the trusted default API base unless you intentionally control and trust an alternate endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Configurable API Base URL May Expose Bearer Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–40; the variable is used in authenticated request examples at lines 74–88
Vulnerability Type: Unvalidated authentication endpoint configuration
Risk Level: Medium

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The configured value is subsequently used with the bearer credential:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

Technical Analysis

The shell initialization preserves any pre-existing DDT_OPEN_BASE environment variable without validating its URL scheme or hostname. Authenticated requests subsequently combine that configurable endpoint with an Authorization: Bearer header containing DDT_API_KEY.

Environment variables may be inherited from a parent process, development environment, shell profile, CI configuration, container configuration, or launcher. If an attacker can influence DDT_OPEN_BASE, requests can be redirected to a server under the attacker's control. That server would receive the bearer credential and submitted query parameters.

The documented default endpoint uses HTTPS, but no check ensures that an overridden value also uses HTTPS or belongs to the expected gotoshop-ai.com host. Consequently, the configuration permits credential transmission to an arbitrary HTTPS host or potentially over plaintext HTTP.

Attack Path

1. An attacker compromises or influences the environment used to invoke the Skill.
2. The attacker sets DDT_OPEN_BASE to an attacker-controlled endpoint, such as https://attacker.example.
3. The documented initialization retains this existing value because ${DDT_OPEN_BASE:-...} only applies the default when the variable is unset or empty.
4. The user or Agent runs one of the d ...[truncated 1025 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the trusted API origin when attaching the bearer credential:

   bash

   DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required, parse and validate the URL before issuing requests. Require:
   • The https scheme.
   • An exact approved hostname.
   • An approved port.
   • An expected path prefix.
   • No embedded user information.
3. Reject inherited or user-supplied endpoint values by default instead of silently trusting them.
4. Ensure credentials are not forwarded during cross-origin redirects. Consider disabling redirects entirely for authenticated API requests.
5. Separate development endpoints from production credentials. Test or staging endpoints should use distinct, narrowly scoped credentials.
6. Use short-lived, least-privilege API tokens where supported, and document immediate token revocation and rotation if endpoint poisoning is suspected.
7. Add a preflight check that terminates the request without displaying the key when the endpoint fails validation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep