腾讯地图地址·零售连锁门店网络分析

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent retail-analysis API guide, but its documented commands can send the API bearer token to an arbitrary inherited endpoint.

Review before installing. Use only the official HTTPS DDT endpoint, avoid inheriting or overriding DDT_OPEN_BASE unless you fully trust it, and use a scoped or rotatable API key. Treat submitted coordinates or business-planning queries as potentially sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

Configurable API Endpoint Can Expose the Bearer Token

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–31 and 65–79
Vulnerability Type: Unvalidated credential-bearing API endpoint
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The documented initialization preserves any preexisting DDT_OPEN_BASE value instead of enforcing the intended API origin. Subsequent commands attach DDT_API_KEY as a bearer credential to requests constructed from that variable.

No validation ensures that the endpoint uses HTTPS or belongs to the expected gotoshop-ai.com origin. If the execution environment is compromised or incorrectly configured, authenticated requests can therefore be redirected to an attacker-controlled server.

Although the Skill warns users not to expose the key in chat, logs, or version control, that warning does not mitigate credential disclosure through an untrusted endpoint.

Attack Path

1. An attacker, compromised startup script, or poisoned runtime configuration defines DDT_OPEN_BASE as an attacker-controlled URL.
2. The documented export statement retains that existing value.
3. The user or Agent invokes one of the documented curl commands.
4. curl sends the Authorization: Bearer $DDT_API_KEY header to the attacker-controlled endpoint.
5. The attacker captures the bearer token and any ...[truncated 789 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin credential-bearing requests to the expected HTTPS origin rather than inheriting an arbitrary environment value:

bash

readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"

2. If endpoint overrides are operationally necessary, validate the parsed URL before sending credentials:

   • Require the https scheme.
   • Require an exact allowlisted hostname.
   • Reject embedded user information, unexpected ports, and deceptive suffixes.
   • Prefer an allowlist of complete trusted origins rather than substring matching.

3. Separate production and development credentials. Never send production bearer tokens to staging, local, or user-defined endpoints.

4. Make endpoint overrides explicit and opt-in instead of silently accepting inherited environment state.

5. Use short-lived, narrowly scoped tokens where the service supports them, and provide token rotation and revocation procedures.

6. Avoid exposing authorization headers in command tracing, diagnostics, process wrappers, or logs.

7. Add a preflight check that fails closed when endpoint validation does not pass, before constructing any authenticated request.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep