T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:447- Finding
Authentication QR Codes Are Forwarded Outside the Initiating Conversation
- Content
View full analysis
- Remediation
View remediation
Security audit
1688运营数据日报
Security checks for vulnerabilities and agentic risk
Overview
This skill appears intended to collect 1688 seller analytics, but it uses broad browser and messaging privileges that could expose login QR codes, seller data, and tokens beyond the requesting user.
Review before installing. Use this only in a dedicated, low-privilege environment with a separate browser profile. Restrict the extension to 1688 origins, remove wildcard external extension access, avoid forwarding login QR codes to any group unless the user explicitly confirms that recipient, verify all downloaded installers by hash/signature, and protect Feishu tokens, QR images, and raw seller reports with private storage permissions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (9)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
plugin/background.js:237- Finding
Any Installed Extension Can Retrieve the Complete Stored Seller Dataset
- Content
View full analysis
{ (async () => { log('收到外部消息:', request.action, 'from:', sender.id || sender.origin); try { switch (request.action) { case 'OPEN_CLAW_API': { const store = await Storage.getDataStore(); const { mode = 'full', offerId, limit = 50, keyword } = request; let responseData = {}; if (mode === 'full') { responseData = { sycm: store.sycm.slice(0, limit), work: store.work.slice(0, limit), stats: store.stats }; } else if (mode === 'sycm') { responseData = { sycm: store.sycm.slice(0, limit) }; } else if (mode === 'work') { responseData = { work: store.work.slice(0, limit) }; } else if (mode === 'summary') { responseData = await DataProcessor.getSummary(); } sendResponse({ success: true, clawVersion: CLAW_VERSION, source: '1688-data-claw', data: responseData }); break; } ``` ### Technical Analysis The manifest permits external connections from every extension ID through `"ids": ["*"]`. The external message handler logs the sender but does not authenticate or authorize it. An `OPEN_CLAW_API` request can return complete `sycm` and `work` records, including transaction, inquiry, ranking, company, traffic, and account-related data. The fixed extension ID documented by the project makes discovery straightforward. Merely being ...[truncated 827 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
plugin/content.js:86- Finding
1688 Authentication Token Is Logged and May Be Persisted as an Account Identifier
- Content
View full analysis
{ const match = document.cookie.match(new RegExp('(?:^|;\\s*)' + name + '=([^;]+)')); return match ? match[1] : ''; }; const loginId = getCookie('loginId'); if (loginId) return 'login_' + loginId; const unb = getCookie('unb'); if (unb) return 'unb_' + unb; const memberId = getCookie('memberId'); if (memberId) return 'member_' + memberId; const m_h5_tk = getCookie('_m_h5_tk'); if (m_h5_tk) { const token = m_h5_tk.split('_')[0]; if (token) return 'token_' + token; } return location.host; } ``` ```javascript const m_h5_tk = getCookie('_m_h5_tk'); if (!m_h5_tk) { log('工作台采集: 未找到 _m_h5_tk cookie'); return result; } const token = m_h5_tk.split('_')[0]; log('工作台 token:', token); ``` ### Technical Analysis The collector reads `_m_h5_tk`, extracts its token component, and prints it to the browser console while debug logging is enabled. If preferred account cookies are absent, the same token is incorporated directly into `accountId`, which is then stored in `chrome.storage.local`. Because the stored dataset is also exposed through the external extension API, this behavior creates multiple disclosure paths. Authentication material should never be used as a stable identifier or written to logs. ### Attack Path 1. The content script runs in an authenticated 1688 session. 2. It reads `_m_h5_tk` from `document.cookie`. 3. It logs the token to the developer console. 4. If other identifiers are unavailable, it stores `token_` as `accountId`. 5. A local user, debugging integration, compromised page environment, or malicious extension retrieves the token or derived identifier. 6. The exposed value may be used for acco ...[truncated 461 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/start-browser.sh:46- Finding
Extension and Chromium Run with Excessive Privileges
- Content
View full analysis
/tmp/chromium.log 2>&1 & ``` ### Technical Analysis The extension’s declared purpose requires access to 1688 domains, but it requests access to every HTTPS origin and localhost. The launcher additionally disables Chromium’s security sandbox and permits every origin to initiate DevTools WebSocket connections. CDP provides powerful capabilities including arbitrary JavaScript evaluation, navigation, screenshots, and cookie manipulation. These settings materially increase the consequences of a browser, extension, or local-web-origin compromise. ### Attack Path 1. An attacker compromises a page, extension, or local application able to reach the CDP listener. 2. The unrestricted DevTools origin policy permits a connection attempt. 3. CDP access provides control over authenticated browser tabs and page execution. 4. The disabled browser sandbox increases the impact of a Chromium renderer or browser exploit. 5. Broad extension host access permits interaction beyond the 1688 domains required by the Skill. ### Impact Assessment A successful attacker may control the isolated authenticated browser profile, inspect seller data, navigate tabs, execute page code, capture screenshots, or manipulate sessio ...[truncated 126 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/start-browser.ps1:16- Finding
Spoofable Marker File Can Redirect Privileged CDP Operations
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/setup.ps1:71- Finding
Setup Downloads and Executes Mutable Remote Code Without Integrity Verification
- Content
View full analysis
&1 | tail -1 if ! curl -L -o "$CHROMIUM_ZIP" "$download_url" --connect-timeout 15 --max-time 300; then download_url="https://storage.googleapis.com/chrome-for-testing-public/$version/linux64/chrome-linux64.zip" curl -L -o "$CHROMIUM_ZIP" "$download_url" --connect-timeout 15 --max-time 300 fi unzip -o "$CHROMIUM_ZIP" -d "$SKILL_DIR/chromium/" > /dev/null ``` ### Technical Analysis The setup process downloads Chromium and Python archives without verifying pinned hashes or vendor signatures. It also retrieves the mutable `get-pip.py` bootstrap script and immediately executes it. Linux globally installs `@larksuite/lark-cli`, despite current documentation stating that the active push path does not depend on it. HTTPS protects transport but does not protect against a compromised mirror, registry account, upstream publication process, or unexpected artifact replacement. The pre-scan claim that `setup.sh` uses `curl | bash` was not confi ...[truncated 882 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_data.py:30- Finding
Sensitive Reports, Tokens, and QR Codes Are Written to Predictable Files with Default Permissions
- Content
View full analysis
1 else os.path.join(TMP_DIR, '1688_raw_data.json') ``` ```python with open(OUTPUT, 'w', encoding='utf-8') as f: json.dump(all_data, f, ensure_ascii=False, indent=2) ``` ```python TOKEN_CACHE = Path(__file__).resolve().parent / '.feishu_token.json' with open(TOKEN_CACHE, 'w', encoding='utf-8') as f: json.dump({'token': token, 'expire': time.time() + expire_in}, f) ``` ```python output_path.parent.mkdir(parents=True, exist_ok=True) with open(str(output_path), 'wb') as f: f.write(img) ``` ### Technical Analysis Raw seller analytics, Feishu bearer tokens, and authentication QR images are created with predictable names using ordinary `open()` calls. The code does not enforce private file permissions, validate ownership, prevent symlink traversal, or securely clean up expired artifacts. In shared environments, the effective file mode depends on the process umask and directory permissions. Predictable locations also permit pre-created symlink attacks. ### Attack Path 1. A local attacker predicts `/tmp/1688_raw_data.json`, `.feishu_token.json`, or `1688_qrcode.png`. 2. The attacker monitors the path, accesses a permissively created file, or pre-creates a symbolic link. 3. The Skill writes seller data, a bearer token, or a QR image. 4. The attacker reads the sensitive content or causes the process to overwrite another file accessible to the Skill’s user. 5. A stolen Feishu token may be used until expiry within the application’s granted permissions. ### Impact Assessment The issue may disclose confidential business analytics, live authentica ...[truncated 164 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/start-browser.sh:11- Finding
Launcher Force-Kills Unrelated Xvfb Processes Despite Declared Non-Destructive Behavior
- Content
View full analysis
/dev/null; then echo ">>> 启动 Xvfb..." pkill -9 Xvfb 2>/dev/null || true rm -f /tmp/.X99-lock /tmp/.X11-unix/X99 Xvfb "$DISPLAY" -screen 0 "$SCREEN" -ac & sleep 2 fi ``` ### Technical Analysis The launcher invokes `pkill -9 Xvfb`, which targets processes by name rather than a PID owned and created by this Skill. This contradicts the documentation’s claim that the Skill never kills processes. Although the surrounding condition may make the command ineffective in many normal cases, process-state races and name matching make global force termination inappropriate. Removing shared X11 lock/socket paths is also unsafe when ownership is not established. ### Attack Path 1. Another user or workload operates an Xvfb process or is starting one concurrently. 2. The Skill performs its process check and enters the startup branch due to a race or transient state. 3. `pkill -9 Xvfb` targets matching processes globally within its permission scope. 4. The unrelated virtual display is terminated without cleanup. 5. GUI applications, browser sessions, or automation jobs attached to that display fail. ### Impact Assessment The command can disrupt unrelated workloads accessible to the executing account. If run with elevated privileges, the disruption scope may include all users’ Xvfb sessions. Abrupt SIGKILL termination can cause data loss in dependent applications. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report_v3.py:302- Finding
Unescaped Platform-Controlled Text Is Embedded in Agent-Reviewed and Feishu-Rendered Reports
- Content
View full analysis
{s(cate2)} 层级：{rank_str}{rank_trend} ``` ### Technical Analysis Company names, categories, traffic-source names, and keywords originate from authenticated platform responses and are inserted directly into Markdown tables and report text. The values are not escaped for pipes, line breaks, HTML, links, or other Markdown control syntax. The Skill subsequently directs the agent to read and modify portions of the generated report before sending it to Feishu. Consequently, crafted platform data can both corrupt the rendered report and present instruction-like content to the agent. ### Attack Path 1. An attacker influences a company name, category, keyword, or traffic-source string visible in the seller analytics. 2. The extension collects the attacker-controlled value from 1688. 3. `generate_report_v3.py` embeds it verbatim into Markdown. 4. Markdown delimiters or line breaks alter table/report structure, inject links or deceptive content, or add instruction-like text. 5. The agent reads the generated report as part of the required review workflow. 6. The manipulated content may influence agent output or be rendered to Feishu recipients as trusted report content. ### Impact Assessment An attacker can alter report presentation, insert misleading links or content, and create an indirect prompt-injection surface against the reviewing agent. This does not independently prove arbitrary code execution, but i ...[truncated 91 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (95)
Tainted flow: 'h' from os.environ.get (line 163, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python h = host or CDP_HOST p = port or CDP_PORT try: with urllib.request.urlopen(f'http://{h}:{p}/json/version', timeout=3): pass except Exception: return False
Tainted flow: 'CDP_HOST' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def get_1688_tab(): """快捷函数：获取当前1688页面的 CDP 连接信息""" with urllib.request.urlopen(f'http://{CDP_HOST}:{CDP_PORT}/json/list') as resp: tabs = json.loads(resp.read()) for t in tabs: if t['type'] == 'page' and '1688.com' in t.get('url', ''):
Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={'Content-Type': 'application/json'}, method='POST', ) with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode('utf-8')) if data.get('code') != 0: raise RuntimeError(f'获取 token 失败: code={data.get("code")} msg={data.get("msg")}')
Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python }, method='POST', ) return urllib.request.urlopen(req, timeout=15) try: with _post() as resp:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill performs browser/Xvfb orchestration, remote-debugging port probing, extension loading, and marker-file ownership checks, which are sensitive local-environment control features not evident from the title/description. Such hidden control-plane behavior increases attack surface and can interfere with host/browser security expectations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide documents an external messaging API that allows other extensions and 1688-domain webpages to communicate with the plugin, while collected seller analytics are retrievable through OPEN_CLAW_API. Combined with the manifest example showing externally_connectable ids set to wildcard and 1688 webpages allowed, this creates a strong risk of unauthorized cross-extension or webpage access to sensitive business data if callers are not strictly authenticated and authorized.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code provides cross-extension/external access to locally stored collected data through OPEN_CLAW_API without validating the caller. In a browser-extension context, exposing aggregated business data to external requesters creates a direct confidentiality risk because any trusted external messaging peer can pull the dataset without user awareness.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
json { "manifest_version": 3, "name": "1688 Data Claw - 数据采集器", "version": "1.0.0", "description": "采集1688店铺经营数据，为OpenClaw提供结构化数据接口", "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAur6CE+BGEBWB5atgTevs6vDdZ6meGWEF+rhbEE5RPwraDMAPRjj3a3arI0nu499MVxHRHIso7U96k7U1sPC6MDpjgHyGEQora44bUp5mv5O4pztCLF+/b9nETcXlmJjJLf/3B4clXKC1PCJDQgODbl6HIUL5RumrDDkJM93jc/2hHetJS0cGvisO9tE0jYYmGsUtJ0SA7yJS73NuH1xbhzj5+xrYAR92b/rgpe1RXuQLyotvKqUnGCdw1aAs/T4nNJ3YSFevted0cqjvU0zTvFVf8UooH6uRbgHpE0gHiD2aO5B0z4ZBdq38MbMPbtTLhYqq78pgJRXiGt9SIxXAywIDAQAB", "permissions": [ "activeTab", "storage", "scripting", "tabs", "background" ], "ex
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest claims the extension only collects 1688 seller workspace data, but its host permissions include
https://*/*, granting potential access to essentially any HTTPS origin. In a browser extension, this broad scope materially expands the blast radius: if the extension logic is abused or later modified, it could read from or inject into unrelated sites beyond the stated business purpose.- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python else: script = SKILL_DIR / 'scripts' / 'start-browser.sh' cmd = f'bash "{script}"' result = subprocess.run(cmd, shell=True, check=False) return result.returncode == 0
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script downloads get-pip.py from the internet and immediately executes it with the bundled Python interpreter, which is direct execution of remote installer code at setup time. If the source, transport, or upstream content is compromised, arbitrary code can run on the user's machine with the privileges of the setup process.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The script fetches remote JSON to determine the browser version and uses that untrusted network response to select which binary to download. Although it is not directly piping shell code into execution, it still delegates installation decisions to mutable remote content, which is dangerous because a compromised upstream or mirror could steer the setup toward malicious or unexpected artifacts.
- Content
sh echo ">>> 获取最新 Chromium 版本..." # 从 npmmirror 获取最新稳定版号 version=$(curl -s "https://registry.npmmirror.com/-/binary/chrome-for-testing/last-known-good-versions.json" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['channels']['Stable']['version'])" 2>/dev/null) echo " 最新稳定版: $version"
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text # ============================================================ # 1688 Data Claw - Windows launcher # Start or reuse an independent Chromium instance (headless) # Uses a marker file to identify our instance (no process kill)