Affiliate Marketing Auto

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:18 AM UTC
• Version: 1.0.2

Overview

This skill looks like an affiliate-marketing automation tool, but important production-facing features return fabricated products, links, and revenue analytics without clear labeling.

Review carefully before installing. Do not use this for real campaigns until real affiliate APIs, verified short-link creation, truthful content templates, clear synthetic-data labels, privacy controls, and dependency updates are in place. Treat its current product results, revenue reports, forecasts, and short links as demo output, not reliable business data.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

other

Error

• Location: src/product-finder.js:50
• Finding: Configured affiliate-platform searches silently return fabricated product data<![CDATA[ ## Vulnerability Details **File Location**: `src/product-finder.js:50-64`, `src/product-finder.js:138-188` **Vulnerability Type**: Fabricated data presented as affiliate-platform results **Risk Level**: High ### Vulnerable Code ```javascript // Search each platform if (this.platforms.amazon) { const amazonProducts = await this._searchAmazon(options); products.push(...amazonProducts); } if (this.platforms.shareasale) { const shareasaleProducts = await this._searchShareASale(options); products.push(...shareasaleProducts); } if (this.platforms.cj) { const cjProducts = await this._searchCJ(options); products.push(...cjProducts); } // If no products were returned, use simulated data if (products.length === 0) { console.log('⚠️ 未配置联盟平台，使用演示数据'); products.push(...this._getDemoProducts(options)); } ``` ```javascript async _searchAmazon(options) { // A real implementation should call the Amazon Product Advertising API console.log('🔶 搜索 Amazon 联盟产品...'); return []; } async _searchShareASale(options) { // A real implementation should call the ShareASale API console.log('🔵 搜索 ShareASale 产品...'); return []; } async _searchCJ(options) { // A real implementation should call the CJ Affiliate API console.log('🟢 搜索 CJ Affiliate 产品...'); return []; } // Demo data generation _getDemoProducts(options) { const categories = { electronics: ['笔记本电脑', '无线耳机', '智能手表', '平板电脑', '相机'], fitness: ['瑜伽垫', '哑铃', '跑步机', '健身追踪器', '运动服装'], beauty: ['护肤品套装', '口红', '香水', '面膜', '精华液'], home: ['空气净化器', '扫地机器人', '咖啡机', '床上用品', '灯具'], fashion: ['手表', '包包', '太阳镜', '运动鞋', '珠宝'] }; const category = options.category || 'all'; let productNames = category === 'all' ? Object.values(categories).flat() : (categories[category] || categories.electronics); return productNames.map((name, index) => ({ id: `prod_${Date.now()}_${index}`, name: name, category: category === 'all' ? 'electronics' : category, pri ...[truncated 2483 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement each advertised integration using the platform's authenticated official API. 2. Return a clear unsupported-integration or upstream-service error when an adapter is unavailable. 3. Place synthetic results behind an explicit option such as `demoMode: true`; never enable it implicitly. 4. Add `synthetic: true` and provenance metadata to every demonstration object. 5. Prevent synthetic objects from entering publication, tracking, or production analytics workflows. 6. Validate platform credentials during `configure()` and report authentication failures. 7. Add tests proving that configured integrations never silently fall back to demo results. 8. Remove unused network dependencies until genuine integrations are implemented. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: src/content-generator.js:150
• Finding: Promotional templates generate unsupported testing, quality, scarcity, and cashback claims<` ]; return sections.join('\n\n'); } ``` ```javascript xiaohongshu: { platform: '小红书', title: `💖 ${product.name}真实评测！`, content: `姐妹们！今天给大家安利一个超好用的${product.category}！\n\n✨ ${product.name}\n💰 价格：$${product.price}\n⭐ 评分：${product.rating}\n\n使用感受：${product.description}\n\n真心推荐！性价比超高～\n\n#好物分享 #${product.category} #种草 #购物推荐`, tags: ['好物分享', product.category, '种草', '购物推荐'], imageCount: 3 }, ``` ```javascript _generateEmailSubject(product) { const subjects = [ `🔥 限时优惠：${product.name} 仅需$${product.price}！`, `您不能错过的${product.category}：${product.name}`, `${product.name} - ${product.rating}星好评的${product.category}`, `特别推荐：${product.name}（内含独家优惠）` ]; return subjects[Math.floor(Math.random() * subjects.length)]; } ``` ### Technical Analysis The templates make factual assertions that are not supported by any verification mechanism. They state that a product was actually tested, performed exceptionally, exceeded similarly priced products, had limited inventory, and was subject to a ...[truncated 1568 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove claims of actual testing, personal experience, superiority, scarcity, and exclusivity unless verified evidence is supplied. 2. Distinguish affiliate commission from buyer discounts or cashback. 3. Include a clear affiliate disclosure in every promotional output by default. 4. Require provenance fields such as `verifiedPrice`, `verifiedOffer`, `testedByPublisher`, and `sourceUpdatedAt`. 5. Render unverified statements as neutral descriptions rather than factual endorsements. 6. Validate URLs and escape product fields for Markdown, email, HTML, and each supported social platform. 7. Add an approval checkpoint before generated content can be published. 8. Add tests that reject or neutralize unsupported commercial claims. ]]>

other

Error

• Location: src/analytics.js:32
• Finding: Revenue reports and forecasts expose random and hard-coded values as business analytics<![CDATA[ ## Vulnerability Details **File Location**: `src/analytics.js:32-61`, `src/analytics.js:107-136`, `src/analytics.js:162-216` **Vulnerability Type**: Fabricated analytics and financial projections **Risk Level**: High ### Vulnerable Code ```javascript async getReport(options = {}) { const { startDate, endDate, groupBy = 'product', includePredictions = true } = options; console.log(`📈 生成收入报告：${startDate} 至 ${endDate}`); // Generate simulated data; a real implementation should use a database or API const report = { id: `report_${Date.now()}`, generatedAt: new Date().toISOString(), period: { startDate, endDate, days: this._getDaysBetween(startDate, endDate) }, summary: this._generateSummary(startDate, endDate), revenue: this._generateRevenueData(startDate, endDate, groupBy), conversions: this._generateConversionData(startDate, endDate), traffic: this._generateTrafficData(startDate, endDate), topProducts: this._getTopProducts(groupBy), topCampaigns: this._getTopCampaigns(), trends: this._generateTrends(startDate, endDate), predictions: includePredictions ? this._generatePredictions() : null }; this.reports.set(report.id, report); return report; } ``` ```javascript async predict(months = 3) { console.log(`🔮 生成${months}个月收入预测`); const predictions = []; const baseRevenue = 5000; const growthRate = 0.15; for (let i = 1; i <= months; i++) { const predictedRevenue = baseRevenue * Math.pow(1 + growthRate, i); predictions.push({ month: i, date: this._addMonths(new Date(), i).toISOString().split('T')[0], predictedRevenue: Math.round(predictedRevenue), confidence: Math.max(0.95 - (i * 0.05), 0.7), range: { low: Math.round(predictedRevenue * 0.8), high: Math.round(predictedRevenue * 1.2) } }); } return { generatedAt: new Date().toISOString(), months: months, predictions: p ...[truncated 2544 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Connect analytics to authenticated affiliate-provider data or a documented internal event store. 2. Reject report requests when no production data source is configured. 3. Isolate simulation behind an explicit demo API and visibly watermark every simulated report. 4. Include source, collection time, record count, and data-quality metadata. 5. Reconcile reports with LinkTracker or remove claims that LinkTracker feeds revenue analytics. 6. Build forecasts from documented historical models and measured observations. 7. Do not emit confidence scores unless they are statistically derived and explained. 8. Add deterministic consistency, provenance, and date-validation tests. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: src/link-tracker.js:320
• Finding: Short-link API returns an unregistered third-party URL as if it were active<![CDATA[ ## Vulnerability Details **File Location**: `src/link-tracker.js:34-67`, `src/link-tracker.js:320-323` **Vulnerability Type**: Spoofed short-link creation **Risk Level**: Medium ### Vulnerable Code ```javascript async create(options) { const { productUrl, campaign, source, medium, content, term } = options; const linkId = `link_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`; const utmParams = this._buildUTMParams({ campaign, source, medium, content, term }); const trackingUrl = this._appendParams(productUrl, utmParams); const shortUrl = this._generateShortUrl(linkId); const linkData = { id: linkId, originalUrl: productUrl, trackingUrl: trackingUrl, shortUrl: shortUrl, utmParams: utmParams, campaign: campaign || 'default', source: source || 'unknown', medium: medium || 'organic', content: content || '', term: term || '', createdAt: new Date().toISOString(), status: 'active', clicks: 0, conversions: 0, revenue: 0 }; ``` ```javascript _generateShortUrl(linkId) { // Simplified implementation; a real implementation should use a shortening service return `https://short.link/${linkId}`; } ``` ### Technical Analysis The implementation constructs a URL under the external `short.link` domain without making an API request, proving domain ownership, or registering a redirect. There is also no local HTTP redirect handler capable of resolving the generated identifier. The configured tracking domain and shortener settings are ignored. Nevertheless, the returned object labels the link as active and the public API reports successful short-link creation. The in-memory map has no relationship with the external domain, so it cannot cause the returned URL to redirect to `trackingUrl`. This constitutes API spoofing: the method presents a successful tool operation even though the external operation never occurred. ### Attack Path 1. A caller suppli ...[truncated 914 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Integrate an authenticated shortener API and verify that the returned redirect resolves to the intended tracking URL. 2. Alternatively, deploy a controlled redirect endpoint under the configured tracking domain. 3. Never synthesize a URL under a third-party domain. 4. Return the full UTM tracking URL when shortening is unavailable. 5. Mark a link as active only after successful redirect registration and verification. 6. Validate destination schemes and permit only explicitly supported HTTP or HTTPS URLs. 7. Add integration tests that resolve each generated short URL and verify its final destination. 8. Persist redirect mappings securely if a first-party redirect service is implemented. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (32)

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The lockfile pins axios 1.13.6, and the provided advisories include SSRF-related and prototype-pollution-gadget issues. In a skill that performs network fetching and scraping, a vulnerable HTTP client materially increases risk because attacker-controlled URLs, redirects, proxy settings, or response handling may be reachable during normal operation.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: form-data 4.0.5 is reported vulnerable to CRLF injection through unescaped multipart field names and filenames. If this skill ever constructs multipart requests using attacker-influenced values, an attacker may be able to manipulate request structure or inject unintended headers/body parts, which is especially risky in automation that relays external content.

Known Vulnerable Dependency: undici==7.24.3 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: undici 7.24.3 is associated with multiple HTTP desynchronization, response poisoning, and information disclosure advisories. Since cheerio depends on undici and this skill is oriented around automated fetching/parsing, vulnerable HTTP transport behavior could expose fetched data, mix responses across requests, or enable cache/connection-level attacks in network-heavy workflows.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The skill depends on axios via a version range that includes releases flagged with multiple advisories, including SSRF-related and prototype-pollution-assisted attack paths. In an automation skill focused on affiliate marketing, HTTP client functionality is central, so a vulnerable request library is especially risky because it may process untrusted URLs, redirects, proxy settings, or remote content during scraping/tracking workflows.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file advertises real-time click tracking, conversion monitoring, and data export, which affect user and visitor data/privacy. The description does not include any warning or disclosure about collecting analytics data, handling tracked user information, or ensuring consent/compliance before enabling these features.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The setup examples require sensitive credentials such as API keys, associate tags, and user IDs, but the markdown does not warn users to store them securely or avoid hardcoding them in source files. For a skill description, omission of credential-handling guidance is a missing warning because it may impact account security and privacy.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in the skill description. The feature list includes automatic content generation, tracking/management of links, and reporting/analysis, which can affect external accounts or process user/business data, but the document provides no warning or disclosure about those behaviors or their data/privacy implications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises automated content publishing, link tracking, conversion monitoring, and report export capabilities, but the description does not clearly warn users that these actions may post externally, collect marketing analytics, or write files to disk. In an agent context, ambiguous automation around external publishing and data export increases the risk of unintended outbound actions, privacy issues, and filesystem side effects if a user enables the skill without understanding its scope.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The manifest presents the skill description and feature text in Chinese, while other metadata such as platform names and pricing are in English. This creates a natural-language/locale policy concern because the skill appears to assume a specific language without documenting user opt-in or a justified region-specific scope.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: Natural-language strings throughout the file force a single language/locale for user-facing output. The policy requires flagging language constraints when the skill does not provide user opt-in or explain that it is intentionally region-specific.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example records IP address, user-agent, and referrer data for click tracking, which are tracking/telemetry identifiers and may constitute personal data under privacy laws. Because the quick-start demonstrates collecting and storing this data without any notice, consent flow, minimization guidance, or anonymization, adopters may copy the pattern into production and create privacy/compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This JavaScript file contains natural-language comments and console output exclusively in Chinese, including the module description and initialization/export/report messages. Because the skill does not offer language selection or explain that it is intended only for a Chinese-speaking context, it violates the policy against forcing a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The review generator sets the default language to `zh-CN`, forcing a specific locale when the caller does not explicitly choose one. This is a natural-language policy concern because the skill imposes a language preference rather than offering a neutral default or requiring user selection.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The email generator uses `zh-CN` as the default language, which can cause user-facing marketing content to be produced in a specific language even when the user did not request it. That creates an avoidable language-policy violation in natural-language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The video script generator assigns `zh-CN` as the default language, so generated user-facing content will be localized to Chinese unless overridden. This forces a specific language choice without opt-in and falls under the language/locale policy concerns for natural-language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The code sets `language: 'zh-CN'` as the default for content generation, which forces a specific locale unless the caller overrides it. This is a natural-language policy concern because the file does not indicate user choice, opt-in, or a documented region-specific justification for enforcing Chinese output by default.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module records potentially sensitive tracking data including IP address, user agent, referrer, and location without any visible consent, minimization, retention, or access-control safeguards. In a link-tracking context, this increases privacy and compliance risk because the data can identify users or reveal browsing behavior if misused, over-retained, or exposed elsewhere in the system.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript file contains natural-language comments and console output exclusively in Chinese, including the module description and operational messages. Because the skill does not offer a language choice or justify a Chinese-only audience, it may violate language/locale policy requiring user opt-in or documented locale constraints.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code file performs a safety-relevant data handling operation by recording tracking metadata including an IP address, user agent, and referrer. Although the test logs general progress, it provides no user-facing warning, comment, or disclosure that potentially sensitive telemetry is being collected and processed.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: SQP-3 applies to all file types and includes language or locale policy violations when a specific language is forced without user opt-in. This report uses Chinese throughout and does not indicate any optional language support or justified regional limitation.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The entire skill summary is written only in Chinese, while describing a generally applicable affiliate-marketing skill with global platforms such as Amazon, ShareASale, and Facebook. There is no indication that the skill is region-specific or that users can choose their preferred language, which may violate a language/locale policy requiring opt-in or justified constraints.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The example exports a report to './exports', which is a file-writing operation. While the step is labeled as exporting a report, there is no explicit warning or comment that running the example will create files on the local filesystem.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package and the project appears to make outbound HTTP requests, a malicious redirect target could receive bearer tokens, API keys, or other sensitive headers if the application attaches them to requests.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The package description is written entirely in Chinese, which indicates the skill is targeted to a specific language/locale without any visible user choice or opt-in. Under the policy rule, forcing a language preference without offering alternatives is a natural-language policy concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "OpenClaw Community",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0",
    "cheerio": "^1.0.0-rc.12",
    "node-fetch": "^3.3.2"
  },

• Confidence: 91% confidence
• Finding: The dependency version uses a caret range ('^1.6.0'), which allows automatic installation of newer minor/patch releases. This increases supply-chain risk because future installs may pull in unexpected code, including vulnerable or malicious updates, reducing build reproducibility.

Static analysis

No suspicious patterns detected.