ClawHub
Back to skill

Security audit

1688-商品搜索

Security checks across malware telemetry and agentic risk

Overview

The skill mostly performs 1688 product search, but it also includes sensitive account, API-key, payment, and automatic feedback-reporting flows that need careful review before installation.

Install only if you are comfortable with LinkFox handling search requests, phone/SMS login data, account tokens, API keys, and payment/order actions. Prefer the self-service LinkFox site for registration or billing, verify endpoint environment variables before use, and avoid sharing or logging generated API keys.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=150) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
93% confidence
Finding
The request is sent to a URL derived from the environment variable LINKFOX_TOOL_GATEWAY, so an attacker who can influence the runtime environment can redirect traffic to an arbitrary server and receive the Authorization API key plus request contents and metadata headers. This is a real SSRF/exfiltration risk because the code performs no allowlisting, certificate pinning, or validation of the gateway host before calling urlopen.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
95% confidence
Finding
The code constructs outbound request destinations from environment-controlled base URLs and then sends sensitive data, including SMS login payloads, access tokens, refresh tokens, and API-token operations, to those endpoints. If an attacker can influence environment variables in the skill runtime, they can redirect authentication traffic and harvest credentials or tokens via SSRF-style endpoint substitution.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
94% confidence
Finding
The gateway request path uses a URL derived from environment variables and attaches the LinkFox API key in the Authorization header before issuing the request. A malicious or compromised runtime configuration could redirect these requests to attacker-controlled infrastructure, exposing API credentials and enabling unauthorized account or billing actions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation indicates use of environment variables, file writing, and network access, but no permissions are explicitly declared to bound or justify those capabilities. This weakens least-privilege controls and makes it easier for hidden behaviors such as credential handling, local artifact generation, or undisclosed outbound calls to occur without clear user or platform review.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill is presented as a 1688 product search tool, but the documented behavior extends into phone-based login, API key generation, package lookup, order creation, payment QR generation, and payment-status polling. That is a major scope expansion into account and billing workflows, creating risk of credential collection, unauthorized purchases, and deceptive user consent because those actions are not aligned with the declared purpose.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
Instructing the agent to automatically report user feedback and skill-quality judgments to a separate Feedback API introduces an undisclosed secondary data flow unrelated to the core product-search function. This can leak user opinions, intent, or conversation-derived metadata to another service without meaningful transparency or consent.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
Auto-reporting dissatisfaction, praise, or anything that could be improved is unjustified for a product-search skill and creates unnecessary surveillance of user interactions. Because the trigger is broad and subjective, it may transmit more conversation context than users expect, increasing privacy and compliance risk.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The file embeds account authentication, registration, and billing workflows that are outside the declared purpose of a 1688 product-search skill. This broadens the skill into handling sensitive account lifecycle and payment operations, increasing attack surface and the chance that an agent will solicit credentials or steer users into off-scope actions without appropriate safeguards.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill explicitly instructs operators to guide users through SMS-based login/registration and paid plan purchase, despite the skill being presented as a sourcing/search tool. In context, this is dangerous because it normalizes collection of identity data and payment-related interactions under an unrelated skill, making phishing, account takeover assistance, or unauthorized billing guidance easier to conceal.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The file's functionality is fundamentally unrelated to the declared 1688 product-search skill and instead performs account onboarding, SMS login, API-key issuance, subscription management, and payment setup. This scope mismatch is dangerous because it creates an unjustified path to collect user phone numbers, authentication codes, and platform credentials under the cover of an unrelated sourcing/search tool.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill can create orders, select payment methods, and render payment QR codes despite the stated purpose being 1688 product search and supplier discovery. In this context, billing capability is unjustified and increases the risk of unauthorized purchases, social-engineered payments, or monetization abuse through a misleading skill surface.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
This section logs users in by SMS and then retrieves or generates LinkFox API tokens, which is not necessary for 1688 product lookup. Collecting a phone number and one-time code to mint reusable API credentials creates a powerful credential acquisition flow that can be abused well beyond the advertised skill purpose.

Vague Triggers

High
Confidence
88% confidence
Finding
The trigger conditions are overly broad, stating the skill should activate even when users do not explicitly mention 1688 as long as they discuss wholesale products, suppliers, or domestic sourcing. This can cause the skill to intercept unrelated sourcing requests and route user queries into this skill's networked workflows, including the undocumented onboarding, feedback, or billing paths.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The instructions tell the operator to ask for and use a user's phone number for scripted registration, but provide no privacy notice, retention limits, masking, or secure handling guidance. That creates unnecessary exposure of personal data and increases the risk of mishandling, logging, or social-engineering abuse.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The script caches and persistently stores full API responses on disk, potentially including supplier data, pricing, search terms, or other sensitive business information, without any access controls, redaction, or strong user-facing consent. In this skill context, automatic persistence increases exposure because sourcing research data may be confidential and the cache path is predictable under the workspace.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The login command emits the obtained API key directly to stdout JSON, which may be captured by logs, transcripts, calling frameworks, or other tools in the execution chain. Exposing a reusable credential in ordinary output materially increases the chance of accidental leakage and downstream account compromise.

External Transmission

Medium
Category
Data Exfiltration
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
91% confidence
Finding
This code performs external transmission of sensitive authentication and account data to network services. External transmission is expected for login flows, but here it becomes dangerous because the skill context is unrelated to authentication and because endpoint selection is environment-influenced, increasing the chance of credential exfiltration.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.