Yufluent Clawhub Publish Yufluentcn Ecommerce Listing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.3.2

Overview

This is a disclosed cloud-based ecommerce listing generator, with some configuration cautions around where your product data and API key are sent.

Install this only if you are comfortable sending product names, keywords, optional selling points, and your Yufluent API key to the configured Yufluent service. Keep TOKENAPI_BASE_URL pointed at the official intended endpoint, avoid untrusted URLs, and review generated listings before publishing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The request URL is derived from a caller-controlled or environment-controlled base URL, and the client automatically attaches a Bearer API key and request payload to outbound requests. If an attacker can influence TOKENAPI_BASE_URL or the base_url argument, they can redirect traffic to an arbitrary host, causing credential leakage and exfiltration of submitted data; the default allowance of plain HTTP for localhost also weakens transport guarantees.

Content

Scanner excerpt · scripts/yufluent_api.py (reported line 150)May include surrounding context.

python

}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## 快速开始（3 步，60 秒）

1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡）
2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件
3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ...

> 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The README's primary usage example hard-codes --lang zh, and the surrounding documentation presents the skill as a general multi-platform listing generator rather than a China-only or Chinese-only compliance tool. There is no visible user opt-in or explanation that output language is restricted, which creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad generic writing requests such as '优化产品标题' and '写个 Shopify 产品描述', which can cause the skill to activate for ordinary content-generation tasks without clear user intent to invoke this third-party commerce workflow. In this skill, activation routes user product data and generated content through a remote Yufluent service, so overbroad matching increases the chance of unintended data disclosure and unexpected external API use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This plain-text prompt hardcodes its core instruction in Chinese ('你是一位顶级亚马逊 Listing 文案专家') while also separately parameterizing output language later. That creates a natural-language locale constraint in the skill itself without offering a user choice or documenting why the skill must operate in Chinese, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The prompt is written entirely in Chinese and instructs the model from that language context, which can impose a specific language/locale behavior unless the user has explicitly opted into it. Although L14 allows a variable language field, the overall skill framing and requirements remain Chinese-first and do not state that language choice is optional or user-selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template instruction is written to the model in Chinese and frames the skill as a Chinese-language TikTok Shop copywriting expert, which can impose a language/locale preference by default. Although line 14 contains a language placeholder, the top-level instruction still sets a fixed language context without explicit user choice or a documented region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document is entirely framed as a Chinese copywriting standard reference, including the title and multiple instructions tied specifically to Chinese character counts and capitalization rules. Because the file does not state that the skill is region-specific or optional by user preference, it appears to impose a specific language/locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This reference file is written entirely in Chinese and frames itself as an authoritative rule source for prompt injection/RAG use, but it does not state that Chinese is optional or limited to a China-specific workflow. Because the skill content appears intended for general Amazon platform operations across multiple regions, this creates a language/locale policy concern by imposing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire reference file is written as a mandatory Chinese rule source, and lines such as the stated用途 and references to Harness injection indicate it is intended to drive skill behavior. There is no indication that users may opt into another language or that the Chinese-only requirement is justified as a region-specific constraint, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Line L257 states that core search terms and long-tail terms must match the output language and specifically requires Chinese keywords for Chinese sites. This is a natural-language locale constraint presented as a requirement, but the file does not indicate user choice or opt-in for language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The --lang argument defaults to zh, which forces a specific language/locale unless the user explicitly overrides it. This is a natural-language policy concern because the tool imposes a locale choice by default rather than offering neutral behavior or explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script transmits user-supplied product, keywords, and related business content to a remote service via run_skill without an explicit warning or consent prompt. In a skill/harness context, users may assume local processing and inadvertently disclose sensitive commercial or personal data to a third-party backend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The top-level docstring says this file is a 'cloud thin client', which implies a straightforward API wrapper. However, when /skills/*/run returns certain server errors, the code reroutes execution through /agent/turn with crafted session and strategy state, invoking a different orchestration mechanism rather than only acting as a simple thin client.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing docstrings and error/help messages throughout the file are written in Chinese, and the constructed agent prompt at L073 explicitly instructs the agent in Chinese. There is no indication that users can select another language or that this locale restriction is optional or region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The client defaults to an HTTP base URL at L024, and subsequent requests include a Bearer token in the Authorization header and JSON payloads via requests.post. While the code implements the network behavior, there is no user-facing warning, confirmation, or explanatory comment near the default transport choice to disclose that credentials and request data may be sent over the network, potentially unencrypted by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This plain-text prompt template defines how to generate TikTok Shop copy but provides no explicit activation conditions, trigger phrases, or constraints describing when this skill should be used versus not used. For plain text files, that omission can lead to overly broad or unintended invocation because the scope is inferred rather than clearly bounded.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file is entirely written in Chinese, including headings, pricing descriptions, and billing notes, with no indication that users can select another language or that the content is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.31.0, which is not pinned to an exact version. This makes builds non-reproducible and can silently introduce a vulnerable or incompatible release at install time, especially across environments or over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The manifest references requests without pinning to a specific version, while multiple advisories exist for that package family. Because the resolved version is unknown, consumers may install an affected release and inherit known security issues without visibility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language text in the module docstring and function docstrings is exclusively in Chinese, which indicates a fixed language choice rather than offering a user-selectable locale. Under the policy, forcing a specific language without opt-in is a reportable natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The docstring describes the local client as minimal and only needing TOKENAPI_KEY plus requests. However, the code later performs local filesystem writes via Path(args.output).write_text(...), which is a meaningful side effect not reflected in that description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.