腾讯地图地址·零售连锁拓店选址分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent retail site-selection helper, but its documented API setup can send a bearer key to a custom endpoint inherited from the environment.

Use this only in a controlled environment. Set DDT_OPEN_BASE explicitly to the trusted DDT API host or clear inherited values before use, and use a scoped, revocable API key. Do not paste the key into chats or logs, and expect submitted brand names, addresses, and coordinates to be sent to the DDT API.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Environment-Controlled API Endpoint Can Expose Bearer Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34 and 72–87
Vulnerability Type: Unvalidated API base URL used with an authorization header
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The configurable value is subsequently used in authenticated requests:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The shell assignment preserves any preexisting DDT_OPEN_BASE value and does not validate its URL scheme, hostname, port, or origin. The documented requests then attach the bearer credential to that configurable destination.

An attacker who can influence the process environment can set DDT_OPEN_BASE to an attacker-controlled HTTPS endpoint. Following the documented workflow would transmit the Authorization: Bearer header to that endpoint. Request parameters—including brand names, coordinates, addresses represented by coordinates, and store-related queries—may also be disclosed.

This issue does not establish that the Skill is intentionally malicious. It is an insecure configuration pattern that creates a credential-exfiltration opportunity when the execution environment is compromised or improperly configured.

Attack Path

1. An attacker, compromised launcher, shell profile, CI configuration, or wrapper process defines `DDT_OPE ...[truncated 1172 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the trusted HTTPS API origin when sending credentials:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required, parse and validate the URL before making requests. Require:

   • Scheme exactly equal to https
   • Hostname exactly equal to gotoshop-ai.com
   • An approved port
   • An approved base path
   • No embedded user information or ambiguous URL syntax

3. Refuse to send the Authorization header when validation fails. Do not silently fall back to or contact an untrusted destination.

4. Separate production and development credentials. Permit custom development endpoints only with non-production keys and an explicit opt-in mechanism.

5. Use short-lived, narrowly scoped credentials with server-side rate limits, expiration, monitoring, and prompt revocation capability.

6. Document that inherited environment variables must not override the authenticated production endpoint, and sanitize the environment in CI, agent runners, and wrapper scripts.

7. Add an automated test verifying that authenticated requests cannot be directed to an unapproved origin.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output requirements and surrounding document are written as mandatory Chinese-language instructions, including constraints like not showing English enums, with no opt-in or alternative language path. This can violate language/locale policy when users may reasonably expect responses in their own language unless a locale restriction is explicitly offered or justified.

Content

No source excerpt is available for this finding.