腾讯地图地址·汽车后市场门店网络分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This skill is a read-only automotive store-network analysis helper that clearly discloses its external API use and API key requirement, with one credential-handling caution around the configurable API base URL.

Before installing, use this only with a DDT API key you are willing to grant to this service, keep the key out of chats and logs, and leave DDT_OPEN_BASE unset or pinned to the trusted gotoshop-ai.com/ddtclaw origin. Avoid running it in environments where untrusted parties can set environment variables.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Configurable API Origin Can Expose Bearer Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–77
Vulnerability Type: Bearer-token disclosure through an untrusted API base URL
Risk Level: Medium

Vulnerable Code

bash

export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/profile" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/brand/regions" \
  --data-urlencode "brand=中鑫之宝"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/auto-service/nearby" \
  --data-urlencode "lng=120.6" \
  --data-urlencode "lat=31.3" \
  --data-urlencode "radius=3000"

Technical Analysis

The initialization expression preserves any existing value of DDT_OPEN_BASE. Every documented API request then attaches the secret DDT_API_KEY as a bearer token to a URL derived from that variable.

If an attacker can influence the environment used to launch the Skill, the attacker can set DDT_OPEN_BASE to an HTTPS endpoint under their control. The documented curl commands will consequently transmit the authorization header and request parameters to that endpoint.

Shell quoting prevents command substitution through this variable, so this is not a shell-command injection issue. The vulnerability is instead a failure to validate the authorization destination before disclosing a credential.

Attack Path

1. An attacker compromises or influences the launcher, shell profile, container environment, CI configuration, or another mechanism that supplies environment variables.
2. The attacker sets DDT_OPEN_BASE to an attacker-controlled URL, such as https://attacker.example.
3. The documented initialization preserves the malicious val ...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the trusted API origin when attaching the bearer token:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is operationally required, validate the parsed URL before making a request. Allow only the exact expected HTTPS scheme, hostname, port, and base path. Do not rely on substring or suffix matching.

3. Reject non-HTTPS URLs, embedded user information, unexpected ports, alternate hosts, and malformed URLs.

4. Avoid inheriting the authenticated endpoint from an uncontrolled environment. Use a trusted configuration file with restrictive permissions or a deployment-controlled constant instead.

5. Disable redirects for authenticated requests, or independently validate every redirect destination before forwarding the Authorization header.

6. Use a wrapper that adds the authorization header only after destination validation rather than placing the header directly in generic command examples.

7. Rotate DDT_API_KEY immediately if requests may already have been sent while DDT_OPEN_BASE was controlled by an untrusted party. Review API access logs for unknown destinations, unusual usage, or quota consumption.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep