品氪 OpenApi 开放平台 Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:49 AM UTC
• Version: 1.0.1

Overview

This skill appears to be a legitimate Pinkr CRM API helper, but it handles sensitive customer and business data with insecure transport, broad write authority, and unprotected local saving of results.

Install only if you trust the Pinkr integration and can enforce a validated HTTPS PK_API_URL, tightly scoped PK_APPKEY permissions, and explicit review before write operations. Avoid using this in shared workspaces unless local output saving is disabled, protected, or regularly cleaned, because customer and business records may be written to disk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pinkr_openapi_skill.py:16

Finding

API Credential and Sensitive CRM Data Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pinkr_openapi_skill.py:16

Finding

Unrestricted API Endpoint Can Redirect Credentials and CRM Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pinkr_openapi_skill.py:39

Finding

Complete CRM API Responses Persisted Locally without Protection

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependency Produces Non-Reproducible Installations

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tainted flow: 'url' from os.environ.get (line 68, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The request target is taken from PK_API_URL and sent directly to requests.post without validation, while the default endpoint is also plain HTTP. If an attacker or misconfiguration controls the environment variable, the skill can exfiltrate app credentials and sensitive CRM/order/member payloads to an arbitrary server, and HTTP transport further enables interception or redirection.

Content

Scanner excerpt · scripts/pinkr_openapi_skill.py (reported line 77)May include surrounding context.

python

}

    try:
        response = requests.post(url, data=form_data, timeout=30)
        response.raise_for_status()
        return response.json()
    except requests.exceptions.RequestException as e:

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The default API URL uses plain HTTP (http://dev.openapi.pinkr.com) while the skill is designed to transmit authenticated requests and sensitive CRM/customer data. Using an unencrypted transport exposes app credentials, personal data, order data, and business operations to interception or tampering by any attacker on the network path, especially in development or shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The default API base URL is http://dev.openapi.pinkr.com, so member, order, inventory, and credential-bearing requests are transmitted over unencrypted HTTP unless the operator overrides it. This exposes sensitive CRM/SCRM data and the app identifier to interception or tampering by anyone on the network path, which is especially dangerous given the skill handles customer and business records.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents use of environment variables, shell commands (curl, jq), and network access, but does not declare an explicit tool or permission scope. That creates an over-broad execution model where an agent may use capabilities not clearly constrained or user-visible, increasing the risk of unintended network transmission, file writes, or secret handling beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill processes highly sensitive CRM/SCRM data including member profiles, phone numbers, addresses, order history, card numbers, deposits, and coupon activity, yet it does not clearly warn users that this data will be transmitted to a third-party API. Without explicit disclosure and consent cues, users may unknowingly send regulated personal or commercially sensitive data off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill exposes business-affecting write operations such as updating shipment status, refund status, inventory, member data, deposits, coupon redemption, and sales synchronization, but does not include explicit cautions about irreversibility, downstream effects, or the need for user confirmation. An agent could perform state-changing actions that are difficult to undo and materially affect customers, accounting, inventory, or fulfillment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill saves full API responses and formatted output to local files under output/, and those responses can include member names, phone numbers, card numbers, balances, orders, addresses, and other business data. Persisting this data without minimization, consent, access controls, or retention handling increases the risk of local disclosure through shared hosts, backups, logs, or accidental file exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module description, help text, prompts, and user-facing output strings are all written in Chinese, which imposes a single language experience with no opt-in or locale selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified as just requests with no version pin or bounded range, which makes builds non-reproducible and can silently pull in different releases over time. In a security-sensitive integration skill that exchanges CRM/SCRM data with third-party systems, this increases supply-chain risk and makes it impossible to determine whether a vulnerable version is being installed.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because requests is unpinned, the manifest provides no assurance that installation will avoid versions affected by known advisories. For a skill that likely performs authenticated API calls and handles customer, order, membership, or token-bearing traffic, dependency ambiguity is more dangerous because a vulnerable requests release could expose credentials, mishandle TLS/redirect behavior, or leak sensitive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.