腾讯地图地址·零售渠道与竞对分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed retail-analysis API helper with no hidden code, installation hooks, persistence, or unrelated access.

Install only if you trust the DDT service and will provide an appropriate DDT_API_KEY. Before use, make sure DDT_OPEN_BASE is unset or pinned to the documented HTTPS endpoint so the bearer token is not sent to an unexpected host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Environment-Controlled API Base URL Can Expose the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–37 and 72–86
Vulnerability Type: Unvalidated destination for authenticated API requests
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The configurable value is subsequently used in authenticated requests:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The shell parameter expansion preserves any preexisting DDT_OPEN_BASE value without validating its scheme, hostname, port, or path. The documented curl commands then attach the API bearer token to requests sent to that destination.

If an attacker can influence the execution environment, such as through a poisoned shell profile, CI/CD variable, wrapper process, or inherited environment configuration, the attacker can redirect authenticated requests to a server under their control. This violates the principle that credentials should only be transmitted to explicitly trusted and authenticated origins.

Although the examples use HTTPS by default, the configuration accepts arbitrary destinations, potentially including an attacker-controlled HTTPS endpoint or a plaintext HTTP endpoint.

Attack Path

1. The attacker gains the ability to define or modify an inherited environment variable.
2. The attacker sets DDT_OPEN_BASE to an attacker-controlled URL.
3. A user or agent executes the initialization ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin authenticated requests to the documented origin rather than inheriting an unrestricted environment value:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

2. If endpoint configurability is required, validate it before sending credentials. Enforce:

   • The https scheme.
   • An explicit hostname allowlist.
   • An expected port.
   • No embedded user information.
   • An approved base path.

3. Refuse the request when validation fails, and never attach the Authorization header to an untrusted origin.

4. Separate production and development credentials. If local or staging endpoints must be supported, use distinct limited-scope keys for each approved environment.

5. Apply least privilege, expiration, rotation, and usage monitoring to API keys. Revoke and rotate any key suspected of exposure.

6. Document that proxies, redirects, and inherited environment variables must not move authorization headers outside the approved service origin. Configure the HTTP client to reject unsafe cross-origin redirects.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep