Popmart Stock Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible PopMart stock monitor, but it overstates its implemented capabilities and encourages persistent monitoring, plaintext credential configuration, and broad webhook/network use without enough safeguards.

Review carefully before installing. Treat this as an incomplete prototype, not a reliable stock monitor. Do not add real API secrets or webhook tokens to workspace JSON unless you understand who can read that file, and do not enable cron or long-running checks until the implementation is fixed, destinations are constrained, and removal instructions are available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/notifier.py:28

Finding

Unrestricted Webhook Destination Enables Blind Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/example_config.json:24

Finding

Setup Instructions Encourage Plaintext API Credential Storage

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: references/SETUP_GUIDE.md:15

Finding

Unpinned Python Packages and Browser Artifacts Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description promises a multi-channel PopMart restock monitor, explicitly including WeChat Mini Programs, and implies real availability tracking with notifications. This code chunk instead provides a narrow, product-specific wrapper for a single item and uses simulated placeholder checks for JD/Tmall/Taobao only. It hardcodes in_stock to false, constructs search URLs, and prints status to the console on a timer. Because the implemented behavior is materially narrower and lacks key declared capabilities—especially real stock monitoring, WeChat coverage, and meaningful notifications—the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description presents a broader skill for monitoring PopMart restocks across several platforms and notifying users. The supplied code chunk only covers a Taobao handler. Within that scope, the API branch is explicitly a placeholder, and the scraping branch merely fetches a Taobao search URL and returns hardcoded/placeholder stock data rather than robustly determining availability. There is no evidence here of WeChat Mini Program, JD.com, or Tmall handling, nor any notification mechanism. This is therefore a meaningful description-to-behavior mismatch, primarily because the actual implemented behavior is substantially narrower and partially stubbed compared with the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes capabilities that require filesystem access, network access, and likely configuration writes, but it does not declare any explicit tool scope or permissions boundary. That makes the runtime trust model ambiguous and can allow broader-than-expected access if the platform grants default tools, increasing the risk of unauthorized network activity, scraping, or secret handling beyond user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide directly recommends local shell execution and cron-based automation without a prominent warning, consent flow, or safety boundary around executing commands and creating persistent scheduled jobs. In an agentic context, this can normalize dangerous behavior and lead users or agents to run local commands or install persistence with insufficient scrutiny.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The document explicitly instructs creation of a recurring cron job, which introduces persistence on the host and continues operating beyond the immediate session. Even for a legitimate stock monitor, persistence is security-relevant because it can consume resources, generate ongoing network activity, and create a foothold for later misuse if the monitored script or environment is altered.

Content

Scanner excerpt · references/OPENCLAW_INTEGRATION.md (reported line 13)May include surrounding context.

/exec python /Users/panda/.openclaw/workspace/popmart-stock-monitor/scripts/monitor_stars_series.py

text

### Method 2: Create a Cron Job for Automated Monitoring

Set up automatic monitoring with OpenClaw's cron system:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language triggers are very broad and can cause the skill to activate for loosely related prompts without clear boundaries, increasing the chance of unintended execution of monitoring actions. In an agent environment, ambiguous activation phrases can be abused to induce tool use or background monitoring when the user did not explicitly request those specific operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/SETUP_GUIDE.md (reported line 10)May include surrounding context.

Ensure Python 3.8+ is installed

python3 --version

Create virtual environment (recommended)

python3 -m venv popmart-env source popmart-env/bin/activate # On Windows: popmart-env\Scripts\activate

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file instructs users to configure a Feishu webhook and later run a stock-monitoring script, which implies outbound network requests and transmission of product/status data to Feishu. While the guide explains setup, it does not clearly warn users that using the skill will send data to third-party platforms or discuss the privacy implications of those transmissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/notifier.py (reported line 48)May include surrounding context.

python

}
        }
        
        response = requests.post(webhook_url, json=message, timeout=10)
        if response.status_code == 200:
            logger.info("Feishu notification sent successfully")
        else:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function claims to use the Taobao Open Platform API when credentials are present, but it never performs any authenticated API request and instead returns a fabricated stock result. In a stock-monitoring skill, this creates integrity risk by misleading downstream automation or users into believing availability was checked when it was not, potentially suppressing alerts or causing bad purchasing decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The scraping path performs an HTTP request but does not inspect the page for stock data and instead returns a hardcoded 'in_stock': True whenever a 200 response is received. In the context of a restock-monitoring skill, this is dangerous because it can generate false restock notifications or trigger automated actions based on nonexistent availability, undermining trust and potentially causing financial or operational harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The usage section tells users how to run the monitor but does not disclose operational impact before execution. Although later sections mention anti-bot measures and respecting terms of service, the primary run instructions lack an upfront warning that the tool automates access to third-party services and may trigger rate limits or policy issues.

Content

No source excerpt is available for this finding.