Security audit

1688运营数据日报

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent 1688 reporting purpose, but it uses broad browser, extension, CDP, Feishu, and file access in ways that can expose seller data or login QR codes beyond the active request.

Use this only after review or hardening: restrict the extension to required 1688 hosts, remove ids ["*"] or add strict sender authorization, avoid sending login QR codes to any chat other than the active user-approved destination, secure or remove raw-data and token caches, verify downloaded installers, and run the browser in a dedicated isolated profile or machine.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (9)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Agent workflow hijacking forces secondary QR-code delivery and indefinite polling
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: plugin/manifest.json:14
Finding: Unauthenticated external extension API exposes stored seller analytics
Content: View full analysis
{ (async () => { switch (request.action) { case 'OPEN_CLAW_API': { const store = await Storage.getDataStore(); const { mode = 'full', offerId, limit = 50, keyword } = request; let responseData = {}; if (mode === 'full') { responseData = { sycm: store.sycm.slice(0, limit), work: store.work.slice(0, limit), stats: store.stats }; } else if (mode === 'sycm') { responseData = { sycm: store.sycm.slice(0, limit) }; } else if (mode === 'work') { responseData = { work: store.work.slice(0, limit) }; } else if (mode === 'summary') { responseData = await DataProcessor.getSummary(); } sendResponse({ success: true, clawVersion: CLAW_VERSION, source: '1688-data-claw', data: responseData }); break; } } })(); return true; }); ``` ### Technical Analysis The manifest permits every installed extension ID through `"ids": ["*"]`. The external message handler does not validate `sender.id`, authenticate the caller, require a nonce, or request user approval before returning full stored data. The returned records include seller identity and operational information collected from authenticated 1688 pages. Knowing the fixed extension ID is sufficient for another installed extension to invoke the API. ### Attack Path 1. An attacker publishes or compromises another browser extension installed in the is ...[truncated 755 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: plugin/manifest.json:18
Finding: Extension requests access to all HTTPS origins and unrestricted localhost services
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: plugin/content.js:218
Finding: Raw MTOP authentication token is written to browser logs
Content: View full analysis
{ const match = document.cookie.match( new RegExp('(?:^|;\\s*)' + name + '=([^;]+)') ); return match ? match[1] : ''; }; const m_h5_tk = getCookie('_m_h5_tk'); if (!m_h5_tk) { return result; } const token = m_h5_tk.split('_')[0]; log('Workstation token:', token); ``` Debug logging is enabled globally: ```javascript const DEBUG = true; function log(...args) { if (DEBUG) console.log('[1688-Claw]', ...args); } ``` ### Technical Analysis The content script extracts `_m_h5_tk` from the authenticated page and logs the token component used to create Alibaba MTOP request signatures. Debugging is permanently enabled, so this occurs during normal collection. Browser console output can be observed through DevTools, CDP clients, diagnostics, screen sharing, or log-capture software. Authentication material should never be emitted even if its use also requires request-specific signing fields. ### Attack Path 1. The user logs into 1688 in the isolated Chromium profile. 2. The content script reads `_m_h5_tk`. 3. The raw token component is sent to `console.log`. 4. A local process, CDP client, extension, or person with debugging access captures it. 5. The token may be replayed or combined with related session material to issue authenticated requests during its validity period. ### Impact Assessment Exposure may assist unauthorized authenticated API access to the user’s 1688 seller account. Exploitability depends on possession of associated cookies and Alibaba token-validation behavior, but logging the value unnecessarily weakens session confidentiality. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_data.py:27
Finding: Full raw seller records are exported to a predictable temporary file
Content: View full analysis
1 else os.path.join(TMP_DIR, '1688_raw_data.json') ) ``` ```python all_data = c.fetch_data(mode='full', limit=100) if not all_data.get('success'): sys.exit(2) with open(OUTPUT, 'w', encoding='utf-8') as f: json.dump(all_data, f, ensure_ascii=False, indent=2) ``` The exported records retain broad backend objects, including constructs such as: ```javascript result.rawUser = json.data.user; result.rawDiamond = json.data.diamond; ``` ### Technical Analysis The collector writes up to 100 full extension records to a predictable filename, `/tmp/1688_raw_data.json` by default on Linux. Standard `open()` follows existing symbolic links and uses permissions derived from the process umask rather than enforcing owner-only access. The extension retains raw user, ranking, product, traffic, inquiry, and transaction response objects beyond the fields needed by the report generator. This increases both exposure and retention scope. ### Attack Path 1. A local attacker monitors the predictable path or creates a symbolic link at `/tmp/1688_raw_data.json`. 2. The user runs `fetch_data.py`. 3. The script opens the path without exclusive creation or symlink protection. 4. Full seller analytics are written to an attacker-readable target, or an unintended writable file is overwritten. 5. The data remains after report generation unless manually deleted. ### Impact Assessment The issue can disclose seller identity, traffic, financial performance, transaction, refund, keyword, and operational data to local users or processes. Under suitable file ownership and execution conditions, symbolic-link ma ...[truncated 79 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/push_feishu_post.py:63
Finding: Feishu bearer token is cached in plaintext without enforced file permissions
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/setup.ps1:94
Finding: Windows setup downloads and executes an unverified remote Python script
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.sh:14
Finding: Linux setup globally installs an unpinned and apparently unused npm package
Content: View full analysis
>> Installing lark-cli..." npm install -g @larksuite/lark-cli 2>&1 | tail -1 ``` ### Technical Analysis The setup installs the latest available version of `@larksuite/lark-cli` globally. No exact version, lockfile, checksum, or package provenance verification is applied. Global installation also expands the package’s installation impact beyond the Skill directory. The documented v3 report sender directly invokes the Feishu API and explicitly states that it does not depend on `lark-cli`, making this dependency unnecessary for the reviewed default functionality. ### Attack Path 1. The user runs `setup.sh`. 2. npm resolves the package version available under the unpinned name. 3. A compromised package account, registry, dependency, or install script supplies malicious code. 4. npm executes package lifecycle behavior with the setup process’s privileges. 5. The global installation can modify shared npm locations and expose malicious tooling to other sessions. ### Impact Assessment A compromised package can execute arbitrary code with the invoking user’s privileges. Running setup as root, which may be encouraged by the included `apt-get` commands, would increase the impact to system-wide compromise. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/start-browser.sh:46
Finding: Authenticated Chromium runs without a sandbox and accepts all DevTools origins
Content: View full analysis
/tmp/chromium.log 2>&1 & ``` ### Technical Analysis The Chromium process contains an authenticated 1688 session but is launched with `--no-sandbox`, removing a major containment boundary for compromised renderer processes. It also enables DevTools and accepts WebSocket requests from every origin through `--remote-allow-origins=*`. The scripts access CDP through loopback, but the launch command does not explicitly set `--remote-debugging-address=127.0.0.1`. Wildcard origin acceptance weakens protection against unauthorized browser-originated or local DevTools connections. ### Attack Path 1. The user authenticates to 1688 in the isolated profile. 2. A malicious page exploits a browser vulnerability or attempts to reach the DevTools interface. 3. Wildcard DevTools origins reduce origin-based connection restrictions. 4. A process that obtains CDP access can inspect tabs, execute JavaScript, capture screenshots, navigate pages, and access the authenticated session. 5. If a renderer exploit succeeds, disabled sandboxing increases the probability and impact of host-level code execution. ### Impact Assessment CDP access provides near-complete control over the isolated browser and its authenticated 1688 session. Disabling the sandbox can turn browser-content compromise into compromise of the operating-system account running Chromium. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (93)

Tainted flow: 'h' from os.environ.get (line 163, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/cdp_client.py (reported line 166)May include surrounding context.
python
h = host or CDP_HOST p = port or CDP_PORT try: with urllib.request.urlopen(f'http://{h}:{p}/json/version', timeout=3): pass except Exception: return False

Tainted flow: 'CDP_HOST' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/cdp_client.py (reported line 328)May include surrounding context.
python
def get_1688_tab(): """快捷函数：获取当前1688页面的 CDP 连接信息""" with urllib.request.urlopen(f'http://{CDP_HOST}:{CDP_PORT}/json/list') as resp: tabs = json.loads(resp.read()) for t in tabs: if t['type'] == 'page' and '1688.com' in t.get('url', ''):

Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/push_feishu_post.py (reported line 90)May include surrounding context.
python
headers={'Content-Type': 'application/json'}, method='POST', ) with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode('utf-8')) if data.get('code') != 0: raise RuntimeError(f'获取 token 失败: code={data.get("code")} msg={data.get("msg")}')

Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/push_feishu_post.py (reported line 137)May include surrounding context.
python
}, method='POST', ) return urllib.request.urlopen(req, timeout=15) try: with _post() as resp:

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill exposes browser/Xvfb process management, remote debugging port setup, and marker-based instance ownership checks, all of which materially expand the attack surface beyond what the description suggests. A CDP-enabled browser process can provide deep access to authenticated sessions and page content if reached by unintended code or local attackers.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented externally_connectable configuration allows any Chrome extension ("ids": ["*"]) to message this plugin, greatly expanding the trust boundary. In the context of a data-harvesting extension handling authenticated seller metrics, a malicious or compromised extension could request sensitive collected data or abuse exposed actions if runtime validation is weak or absent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The background service exposes all collected seller workstation and SYCM data through chrome.runtime.onMessageExternal without any visible authentication, sender allowlist, or user consent gate in this code path. Any external extension permitted by the manifest can query and extract stored business data, turning a local data-collection tool into a cross-extension data-sharing channel.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file implements a cross-extension API that is broader than the stated purpose of fetching 1688 seller workstation data. By offering externally callable OPEN_CLAW_API and GET_VERSION handlers, the extension creates an unnecessary attack surface and enables data brokerage to other extensions or companion software.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The content script automatically uses authenticated session cookies to call internal 1688 APIs and collect account/business analytics without an in-page warning or just-in-time consent. In the context of a browser extension, this enables silent harvesting of sensitive seller operational data from pages the user is merely viewing, which is substantially more dangerous than passive DOM extraction.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatically forwarding the harvested analytics data from the content script to the background process expands exposure from page context to extension-wide context, where additional storage, relay, or upload may occur. Because this transfer happens without user-facing notice and includes sensitive account/business metrics, it materially increases the risk of unauthorized collection and later exfiltration.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · plugin/manifest.json (reported line 5)May include surrounding context.
json
{ "manifest_version": 3, "name": "1688 Data Claw - 数据采集器", "version": "1.0.0", "description": "采集1688店铺经营数据，为OpenClaw提供结构化数据接口", "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAur6CE+BGEBWB5atgTevs6vDdZ6meGWEF+rhbEE5RPwraDMAPRjj3a3arI0nu499MVxHRHIso7U96k7U1sPC6MDpjgHyGEQora44bUp5mv5O4pztCLF+/b9nETcXlmJjJLf/3B4clXKC1PCJDQgODbl6HIUL5RumrDDkJM93jc/2hHetJS0cGvisO9tE0jYYmGsUtJ0SA7yJS73NuH1xbhzj5+xrYAR92b/rgpe1RXuQLyotvKqUnGCdw1aAs/T4nNJ3YSFevted0cqjvU0zTvFVf8UooH6uRbgHpE0gHiD2aO5B0z4ZBdq38MbMPbtTLhYqq78pgJRXiGt9SIxXAywIDAQAB", "permissions": [ "activeTab", "storage", "scripting", "tabs", "background" ], "ex

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest claims the extension is for collecting data from 1688, but it requests host permissions for all HTTPS sites. In a Chrome extension, broad host permissions enable code execution, DOM access, and network interaction far beyond the stated scope, which materially expands the attack surface and could allow collection of sensitive data from unrelated sites if other extension code is compromised or abused.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The public eval() method exposes arbitrary JavaScript execution in the connected browser tab via CDP Runtime.evaluate. In this skill context, that is far more powerful than 'data fetching': it can read page content, interact with authenticated sessions, invoke extension APIs indirectly, alter state, and become a general browser-compromise primitive for any upstream caller that can reach this API.
Content: No source excerpt is available for this finding.