Crossborder Ecom Hub

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 1.0.1

Overview

This skill is a plausible e-commerce management tool, but it asks for powerful store and Feishu access while providing weak safeguards for live business changes and secrets.

Review this carefully before installing. Use only least-privilege test credentials first, avoid passing secrets on the command line, lock down ~/.crossborder-ecom/config.json permissions, and do not run bulk sync, inventory, pricing apply, or Feishu export commands against production accounts until you have previewed exactly what will change or be uploaded.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/cli.js:33
• Finding: Marketplace API Keys Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `bin/cli.js:33`, `commands/platform.js:70-77` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```js // bin/cli.js:30-35 program .option('-k, --api-key <key>', 'API 密钥') .option('-p, --platform <platform>', '目标平台 (tiktok|amazon|shopee|lazada|all)') .option('-o, --output <format>', '输出格式 (json|table|csv)', 'table') .option('--feishu', '启用飞书多维表格同步') .option('--debug', '调试模式'); ``` ```js // commands/platform.js:70-77 const config = { name: platform, apiKey: options.apiKey || '', connected: false, createdAt: new Date().toISOString() }; await platformManager.addPlatform(config); ``` ### Technical Analysis The CLI accepts a marketplace API key directly through the `--api-key` command-line argument. Secrets supplied in this manner may be exposed through: - Shell history files. - Process inspection tools such as `ps`. - Process accounting and monitoring systems. - Terminal session logging. - CI/CD logs or command tracing. - Diagnostic or support bundles. The command handler then copies the argument into the persistent platform configuration. Although the application masks API keys when listing configured platforms, that masking does not protect the original command line or shell history. ### Attack Path 1. A user executes a command such as: ```bash crossborder-ecom --api-key REAL_SECRET platform --add tiktok ``` 2. The full command may be written to the user's shell history. 3. While the process is running, another local process or account with sufficient process-inspection access reads the command arguments. 4. Alternatively, a monitoring, logging, or CI system records the command. 5. The attacker recovers the API key and authenticates to the corresponding marketplace API. ### Impact Assessment Successful exploitation discloses the supplied marketplace API key. The attacker's effectiv ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-key` option for secret input. 2. Accept credentials through a masked interactive prompt that does not echo input. 3. Prefer an operating-system credential manager or secret-management service. 4. If environment variables are supported, document their exposure limitations and avoid printing them. 5. Ensure CI/CD integrations obtain secrets from protected secret stores rather than command-line arguments. 6. Add automated tests confirming that credentials never appear in application logs, status output, errors, or returned command objects. 7. Advise users to rotate keys previously supplied on command lines and remove affected shell-history entries. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/platforms/index.js:329
• Finding: API Credentials Stored in Plaintext Without Explicit Restrictive File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `src/platforms/index.js:329-354`, `bin/cli.js:132-157` **Vulnerability Type**: Insecure local storage of sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```js // src/platforms/index.js:329-354 _getConfigPath() { const path = require('path'); return path.join(process.env.HOME || process.env.USERPROFILE, '.crossborder-ecom', 'config.json'); } _loadConfig() { const fs = require('fs'); try { if (fs.existsSync(this.configPath)) { return JSON.parse(fs.readFileSync(this.configPath, 'utf-8')); } } catch (e) { console.error('Failed to load config:', e.message); } return { platforms: {} }; } _saveConfig() { const fs = require('fs'); const path = require('path'); const dir = path.dirname(this.configPath); if (!fs.existsSync(dir)) { fs.mkdirSync(dir, { recursive: true }); } fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2)); } ``` ```js // bin/cli.js:132-157 const configDir = path.join(process.env.HOME || process.env.USERPROFILE, '.crossborder-ecom'); if (!fs.existsSync(configDir)) { fs.mkdirSync(configDir, { recursive: true }); } const configPath = path.join(configDir, 'config.json'); const defaultConfig = { platforms: {}, feishu: { enabled: false, appId: '', appSecret: '', bitableToken: '' }, pricing: { defaultMargin: 30, strategy: 'competitive' }, inventory: { lowStockThreshold: 10, syncInterval: 300 } }; fs.writeFileSync(configPath, JSON.stringify(defaultConfig, null, 2)); ``` ### Technical Analysis The application instructs users to place marketplace and Feishu credentials in `~/.crossborder-ecom/config.json`. Both the initializer and the platform configuration manager write this file without specifying restrictive permissions. Consequently, the effective file mode is determined by the user's operating-system defaults and umask. In environments with permissive defaults, ...[truncated 1607 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create `~/.crossborder-ecom` with mode `0700`. 2. Create credential files with mode `0600`, for example: ```js fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); fs.writeFileSync(configPath, data, { encoding: 'utf8', mode: 0o600 }); fs.chmodSync(configPath, 0o600); ``` 3. Use an atomic write strategy: - Create a temporary file in the protected directory with mode `0600`. - Write and flush the data. - Rename it over the destination. 4. Check and repair permissions whenever an existing configuration is loaded or saved. 5. Prefer storing secrets in an operating-system credential store or dedicated secret manager. Keep only non-sensitive identifiers and references in the JSON configuration. 6. Do not include secret values in returned objects, exceptions, debug logs, or status output. 7. Document credential rotation procedures and advise users to inspect permissions on existing installations. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/orders.js:104
• Finding: Order CSV Export Allows Spreadsheet Formula Injection and Malformed CSV Records<![CDATA[ ## Vulnerability Details **File Location**: `src/orders.js:104-122` **Vulnerability Type**: CSV formula injection and improper CSV escaping **Risk Level**: Medium ### Vulnerable Code ```js _exportCSV(orders, outputPath) { const headers = ['Order ID', 'Platform', 'Status', 'Amount', 'Currency', 'Customer', 'Created At']; const rows = orders.map(order => [ order.id, order.platform, order.status, order.amount, order.currency || 'USD', order.customer?.name || '', new Date(order.createdAt).toLocaleString() ]); const csv = [ headers.join(','), ...rows.map(row => row.map(cell => `"${cell}"`).join(',')) ].join('\n'); fs.writeFileSync(outputPath, csv, 'utf-8'); return outputPath; } ``` ### Technical Analysis The exporter interpolates order fields into quoted CSV cells without applying proper CSV or spreadsheet-safety encoding. Two distinct problems are present: 1. **Spreadsheet formula injection:** Values beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas by spreadsheet applications. Quoting a value in CSV does not reliably prevent formula evaluation. 2. **Incomplete CSV escaping:** Embedded double quotes are not doubled as required by standard CSV serialization. Embedded line breaks can also alter record structure when not handled by a compliant serializer. Fields such as customer names and external order identifiers may eventually originate from marketplace users. Although current platform adapters generate mock records, the declared functionality anticipates real marketplace data, making these fields untrusted at the export boundary. ### Attack Path 1. An attacker submits marketplace-controlled data containing a spreadsheet formula, such as a customer name beginning with `=`, `+`, `-`, or `@`. 2. The marketplace order is retrieved by the Skill once real platform integration is implemented or the export API is called with attacker-controlled order objects. 3. `exportOrders()` pass ...[truncated 1148 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace manual CSV construction with a maintained CSV serialization library. 2. Correctly escape: - Double quotes by doubling them. - Commas. - Carriage returns and line feeds. - Null and non-string values. 3. Neutralize cells whose first non-whitespace character is `=`, `+`, `-`, or `@`. A common mitigation is to prefix the value with an apostrophe, subject to the intended spreadsheet workflow. 4. Apply formula neutralization to every externally influenced field, not only customer names. 5. Consider offering JSON as the preferred export format when spreadsheet compatibility is unnecessary. 6. Add security tests covering: - `=HYPERLINK(...)` - `+SUM(...)` - `-1+1` - `@SUM(...)` - Embedded quotes - Commas - CR/LF characters - Leading whitespace before formula characters 7. Document that exported marketplace data is untrusted and should be opened with spreadsheet external-content and macro execution disabled. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (60)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document promotes multi-platform synchronization and Feishu data syncing using API-backed integrations, but it does not warn users that these actions may write to external systems, propagate incorrect data, or expose shared business records. In a skill centered on e-commerce operations, undocumented side effects increase the risk of accidental mass updates, inventory inconsistencies, and unintended disclosure of operational data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick-start section includes commands for broad sync, order viewing, pricing analysis, and report generation, but it omits any warning that these operations may transmit business data to third-party platforms or alter remote marketplace and collaboration-system state. Because users are encouraged to run these commands directly after setup, the lack of cautionary guidance makes accidental production-impacting actions more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README promotes one-click bulk cross-platform product synchronization and automatic format conversion without clearly warning that these actions can create or overwrite live listings across multiple marketplaces. In a commerce-management skill, that can cause unintended publication, duplication, catalog corruption, or business-impacting changes if a user misunderstands the scope of the command.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README documents analysis plus one-click pricing application without emphasizing that applying a strategy can immediately alter live prices on connected storefronts. In this context, accidental price changes can directly affect revenue, margins, compliance with marketplace rules, and customer trust.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises real-time inventory synchronization and bulk inventory updates without warning that stock levels may be propagated across platforms automatically. In multi-channel ecommerce, an incorrect sync can trigger overselling prevention in the wrong direction, delist products, or create fulfillment failures across marketplaces.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README instructs users to place multiple marketplace and Feishu secrets in a plaintext local config file, but the guidance at that point does not stress file-permission hardening, exclusion from version control, or safer secret storage options. Because this skill manages several high-value commerce accounts, exposed credentials could enable account takeover, data theft, listing manipulation, or fraudulent operations across platforms.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill advertises automatic cross-platform product, order, inventory, and Feishu synchronization without any warning that these actions can modify remote marketplace data and transmit business data to a third party. In an agent/CLI context, users may invoke these commands expecting read-only behavior, creating risk of unintended listing changes, stock inconsistencies, or external data disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup instructions direct users to place multiple marketplace API keys, secrets, and Feishu credentials into a plaintext config file under the home directory, with no warning about secure storage, file permissions, redaction, or secret rotation. This increases the chance of credential leakage through backups, logs, screenshots, source control, or multi-user systems, which could enable unauthorized access across several commerce platforms.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documented pricing commands include direct application of pricing strategies, including aggressive pricing, without warning that they can change live marketplace prices and materially affect margins, competitiveness, and compliance. In an automated skill, this can lead to rapid business-impacting mispricing if triggered accidentally or with incorrect inputs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Inventory sync and update commands are presented without warning that they may push stock changes across multiple external marketplaces. Accidental execution or misunderstanding could propagate incorrect inventory levels, causing overselling, underselling, or operational disruption across all connected stores.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The init flow creates a local config.json intended to hold platform API credentials and explicitly instructs the user to edit it with API keys, but it provides no warning about secret storage, no permission hardening, and no safer secret-management alternative. In a multi-user system, backup/sync environment, or compromised workstation, plaintext locally stored credentials can be exposed and then used to access connected e-commerce platforms and related business data.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s user-facing description and console output are written entirely in Chinese, which imposes a specific language on users without any visible opt-in or alternative. Under the policy, forcing a language or locale without user choice is a natural-language policy violation unless the regional constraint is documented and justified.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When the --feishu option is used, the command transmits order data to an external Feishu service without any explicit user-facing disclosure of what fields will leave the local environment. In an order-management context, this can expose sensitive business or customer data to third-party systems unexpectedly, especially if operators do not realize the scope of synchronization.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: All user-facing strings in this command are presented in Chinese, including help, status, prompts, and errors, with no option to select another language. This can violate language/locale policy when a skill unconditionally forces a specific language without user opt-in or documented regional justification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The remove flow deletes a configured platform immediately based solely on the provided option, with no confirmation prompt, dry-run, or safety check. In a CLI that manages persistent platform configuration, this increases the risk of accidental destructive actions from user mistakes, scripting errors, or copied commands, potentially causing configuration loss and service disruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The command applies pricing changes immediately when `options.apply` is set, with no confirmation prompt, dry-run safeguard, or explicit warning to the operator. In a pricing automation context, this can cause unintended bulk price modifications across products or platforms due to operator error, bad inputs, or flawed upstream analysis, leading to financial and business impact.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Natural-language strings throughout the file, including descriptions, status messages, and help text, are exclusively in Chinese. This imposes a specific locale on all users without offering a language choice or documenting a justified region-specific constraint.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code sends a generated report to Feishu via `syncReport`, which is a network/data-transmission operation. Although progress is shown, the messaging only indicates that syncing is happening and does not disclose that report contents may be transmitted to an external service or warn about potential sensitivity of sales data.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The file's comments and all console output strings are written in Chinese, with no mechanism for language selection or user preference. This creates a locale policy issue because the skill effectively requires a specific language for operation and status reporting.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When the feishu option is enabled, the command sends the full product dataset to an external Feishu service via feishu.syncProducts(products) without any visible confirmation, consent prompt, or disclosure in this command path. Product records can contain sensitive business information, so silent export to a third party increases the risk of unintended data exposure or policy noncompliance.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This JavaScript demo emits its title, status messages, and usage guidance in Chinese throughout the script. Because the file provides no language-selection mechanism or documented opt-in, it presents a natural-language locale policy concern under the rule for forced language without user choice.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script presents simulated actions as if real platform connections, product synchronization, inventory updates, and reporting occurred, while it only uses delays and mock data. In a commerce integration skill, this can mislead users into believing operational workflows succeeded, causing bad business decisions, false trust in integrations, or skipped validation of real connectivity and data handling.

External Transmission

Medium

• Category: Data Exfiltration

Content

const fetch = require('node-fetch');
    
    try {
      const response = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code sends order information, including order identifiers, amounts, and customer names, to Feishu via HTTP API calls. Although the function name implies syncing, there is no confirmation prompt or explicit disclosure in comments/docstrings that customer-related data will be transmitted to an external service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The report sync uploads the full serialized report object via JSON.stringify(report), which can include arbitrary sensitive business data beyond the explicitly mapped summary fields. Because the entire object is transmitted to a third-party service without field allowlisting or minimization, unexpected confidential data may be exfiltrated if upstream report contents expand over time.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/feishu.js:10

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/feishu.js:43