Yufluent Clawhub Publish Yufluentcn Shopify Operator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:23 AM UTC
• Version: 1.1.2

Overview

This is a coherent cloud Shopify operations skill, but its local Python wrapper has endpoint and import-path choices that could expose the API token or user business context in some installations.

Install only if you trust Yufluent and your local skill directory layout. Set TOKENAPI_BASE_URL only to an endpoint you control or trust, prefer HTTPS, avoid running this from a shared/writable skills parent directory, and treat store URLs and business context as data sent to the configured cloud service.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/run.py:10

Finding

Untrusted External Import Path Can Override Bundled Security-Sensitive Modules

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (13)

Tainted flow: 'url' from os.getenv (line 271, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The code allows the request destination to be derived from TOKENAPI_BASE_URL and defaults to a non-TLS URL, then sends both the Bearer API key and payload via requests.post. If an attacker can influence the environment variable or network path, this can redirect secrets and sensitive task data to an unintended host or expose them in transit.

Content

Scanner excerpt · scripts/yufluent_api.py (reported line 150)May include surrounding context.

python

}
    if body is not None:
        kwargs["json"] = body
    return requests.post(url, **kwargs)


def _raise_for_status(resp: requests.Response) -> None:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 10)May include surrounding context.

powershell

cd skills\yufluentcn-shopify-operator
pip install -r requirements.txt
copy .env.example .env
# 编辑 TOKENAPI_KEY、TOKENAPI_BASE_URL

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

## 快速开始（3 步，60 秒）

1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡）
2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件
3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ...

> 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The primary skill description is written as a Chinese-only operating mode (e.g. '全店运营 教练') with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language docstrings at L01, L13, and L24 are written only in Chinese, which imposes a specific language context without offering any user choice or documented opt-in. Under the stated policy, forcing a specific language/locale without user opt-in is a policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Natural-language strings and the CLI default --lang value are set to Chinese/zh, causing the skill to assume a specific language unless the user overrides it. The file does not present language selection as an explicit choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script collects potentially sensitive user inputs such as store_url, message, and context into a payload and sends them to a remote service via run_skill(...). While the operation is implemented as part of a cloud client, this file contains no user-facing warning, confirmation, logging, or explanatory comment/docstring that these inputs will be transmitted off-host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file's natural-language content is written in Chinese, and the constructed agent instruction also explicitly tells the agent in Chinese to execute directly, implying a fixed language experience. There is no indication that users can choose another language or that the Chinese-only behavior is justified as a documented locale-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

normalize_api_root falls back to http://localhost:8080/v1, which is insecure because Authorization headers and payload data may be sent without TLS. Even when localhost is intended, local proxies, container boundary crossings, or forwarded ports can expose credentials or sensitive content unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code builds a Chinese-only user_message for the /agent/turn endpoint, which hardcodes the interaction language in a way that may violate language/locale policy requirements. No opt-in, fallback language handling, or documented justification for a Chinese-only workflow is present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When /skills/*/run returns 500 or 502, the code transparently falls back to /agent/turn and repackages the full payload into a natural-language orchestration request. This expands data exposure to a broader remote processing path without explicit consent, which can violate user expectations and leak sensitive slot values to a different backend workflow.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any newer release to be installed and makes builds non-reproducible. This increases supply-chain risk and can inadvertently pull in vulnerable or breaking versions over time, especially since the exact installed version cannot be verified during review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest references requests without an exact version pin, while known advisories exist for some releases of that package. Because the installed version is not fixed, it is impossible to determine from this file whether deployment will use a patched or vulnerable version, leaving open the possibility of pulling an affected release.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.