店店通·零售连锁门店网络分析

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This is a coherent retail-store analysis skill that calls a documented API, though users should ensure the API endpoint is trusted before using their key.

Install only if you intend to use the listed retail-data API. Keep DDT_API_KEY out of chats, logs, and repositories, and set or verify DDT_OPEN_BASE is the official trusted endpoint before making authenticated requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Environment-Controlled API Base Can Expose the Bearer Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–26 and 60–75
Vulnerability Type: Unvalidated credential destination
Risk Level: Medium

Vulnerable Code

bash

export DDT_API_KEY="ddt_live_xxxxxxxx"
export DDT_OPEN_BASE="${DDT_OPEN_BASE:-https://gotoshop-ai.com/ddtclaw}"

The documented requests subsequently use the configurable base URL while attaching the bearer credential:

bash

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/profile" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/brand/categories" \
  --data-urlencode "brand=美宜佳"

curl --fail --silent --show-error -G \
  -H "Authorization: Bearer $DDT_API_KEY" \
  "$DDT_OPEN_BASE/v1/retail/nearby" \
  --data-urlencode "lng=121.5" \
  --data-urlencode "lat=31.2" \
  --data-urlencode "radius=3000"

Technical Analysis

The shell initialization preserves any pre-existing value of DDT_OPEN_BASE without verifying its URL scheme or hostname. The request examples then attach DDT_API_KEY as a bearer credential to URLs constructed from that variable.

If the Agent runs in an environment where another process, setup script, or attacker has set DDT_OPEN_BASE to an untrusted origin, authenticated requests will be sent to that origin. The use of curl options that improve failure handling does not validate the destination or prevent this disclosure.

This is an insecure configuration pattern rather than evidence of deliberate malicious behavior. The remaining reviewed instructions are consistent with the declared retail-network analysis purpose.

Attack Path

1. An attacker or compromised environment setup defines DDT_OPEN_BASE as an attacker-controlled URL, such as https://attacker.example.
2. The documented initialization retains that ...[truncated 1069 chars]

Remediation

View remediation

Remediation Suggestions

1. Hard-code the production API origin when attaching the bearer credential:

   bash

   readonly DDT_OPEN_BASE="https://gotoshop-ai.com/ddtclaw"
   

2. If endpoint configurability is required, validate the normalized URL before making requests:

   • Require HTTPS.
   • Allow only an exact approved hostname and port.
   • Reject embedded credentials, unexpected ports, and deceptive hostname suffixes.
   • Do not rely on substring or suffix checks.

3. Do not automatically inherit an ambient DDT_OPEN_BASE. Require an explicit, trusted configuration mechanism for non-production endpoints.

4. Disable or tightly constrain redirects for authenticated requests. Ensure authorization headers cannot be forwarded to a different origin.

5. Separate production and development credentials. Use narrowly scoped, short-lived credentials for testing against approved non-production endpoints.

6. Document that the destination must be validated before adding the Authorization header, and rotate the API key immediately if requests may have been sent to an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest fields and operating instructions are entirely in Chinese, and the output requirements specify presentation details without indicating that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the regional constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.