Security audit

电商 Listing 生成器

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed cloud listing generator, but its reviewed package is not self-contained and can load unaudited neighboring Python client code while using an API key.

Review before installing. Use a scoped, rotatable TOKENAPI_KEY, avoid shared writable skill or _shared directories, verify that the packaged yufluent_api.py is present and from the publisher, and assume submitted product details and identifiers are processed by Yufluent's remote service. Pin dependencies for controlled deployments.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/run.py:14
Finding: Runtime Module Resolution Outside the Audited Skill Enables Import Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements-dev.txt:1
Finding: Editable Development Dependencies Trust Mutable Packages Outside the Project
Content: View full analysis
=2.31.0 ``` ### Technical Analysis The development requirements install two editable packages from relative paths outside the audited project. Their source code and build configuration are not included in the reviewed artifact. Editable installations retain a live relationship with the external source directories. A subsequent modification to either neighboring package can therefore change the code executed by this project without changing the audited Skill. Depending on the package build configuration, installation can also execute build-backend or setup code. The Skill directly imports these packages in `scripts/listing_generator.py` and `scripts/format_listing.py`. A compromised external package would consequently execute with the same privileges as the developer or Agent running the listing generator. This is a supply-chain trust-boundary issue rather than evidence that the referenced packages are currently malicious. ### Attack Path 1. An attacker compromises or modifies `../../packages/tokenapi-sdk` or `../../packages/tokenapi-harness`. 2. A developer follows the documented workflow and runs: ```bash pip install -r requirements-dev.txt ``` 3. Malicious build or setup logic may execute during installation. 4. Alternatively, the editable installation succeeds and retains a reference to the compromised source directory. 5. The developer invokes `scripts/listing_generator.py`, runs tests, or imports `scripts/format_listing.py`. 6. Python imports the attacker-controlled `tokenapi_sdk` or `tokenapi_harness` implementation. 7. Malicious code executes with the privileges and environment of the invoking process. ### Impact Assessment A compromised dependen ...[truncated 635 chars]
Remediation: View remediation
--hash=sha256: tokenapi-harness== --hash=sha256: requests== --hash=sha256: ``` 3. If local monorepo development requires editable installs, explicitly treat the entire monorepo as the security review boundary and audit the referenced packages and their build backends. 4. Run dependency installation in an isolated virtual environment or disposable container without production credentials. 5. Restrict write access to the neighboring package directories and protect them with repository integrity controls. 6. Generate a software bill of materials and verify dependency provenance in CI. 7. Prevent builds from publishing artifacts when dependencies are dirty, unreviewed, or resolved outside the approved repository root. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
## 快速开始（3 步，60 秒） 1. **注册获取 API 密钥** → https://claw.changzhiai.com/login （新用户即送体验积分，无需绑卡） 2. **设置环境变量**：export TOKENAPI_KEY=*** 或写入 .env 文件 3. **运行**：参照下方 Examples 示例执行 python scripts/run.py ... > 还没注册？前往 https://claw.changzhiai.com/login 免费获取密钥。

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README instructs users to export a live API credential and explicitly reuse the same tk-* token across OpenClaw conversations and run.py, but it does not provide adequate guidance on secret handling, token scoping, rotation, or avoiding accidental disclosure in logs, shells, screenshots, and shared environments. In a cloud-harness/agent context, shared credentials increase blast radius because compromise of one channel or component can expose billing-backed access across both interactive and scripted workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The listed trigger phrases include broad requests like "优化产品标题" and "写个 Shopify 产品描述," which overlap with common conversational requests and do not clearly define when this skill should or should not activate. The section also provides only positive examples and no exclusion conditions or narrow invocation context, increasing the chance of unintended activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt text is written in Chinese and frames the interaction in that language, while only the output language is parameterized later via {language_prompt}. This can violate language/locale policy because the skill forces a specific instruction language without offering the user a choice or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The prompt is written as a fixed Chinese instruction ('你是一位顶级 Shopify 电商文案专家') and does not offer any user choice of interface language or explain why Chinese is required. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction requires output in a specific age-coded style: "年轻人口吻". This is a language/locale-style constraint expressed in natural language, and the file does not indicate that the user can opt out or choose a different register.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prompt explicitly instructs the model to use language that matches "Z 世代表达习惯". This imposes a specific linguistic style without documenting user choice or a justified region-specific requirement, which fits the policy's language/style violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown guide is written as a normative specification for Amazon listing copy in Chinese, including requirements such as Chinese character limits and capitalization rules, but it does not state that the guidance is limited to a Chinese-language or China-facing marketplace context. Under the policy, forcing a specific language or locale without user choice or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The title and the entire document are written as a Chinese-only rule source, and the file does not indicate that language selection is optional or limited to a China-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The title and the substantive guidance throughout the file are written in Chinese, and there is no visible statement that users may choose another language or that the content is limited to a China-specific workflow. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L259 states that core search terms and long-tail scenario terms must match the output language, giving a specific example that Chinese sites use Chinese search terms. This imposes a locale/language constraint in natural language without presenting user choice or documenting it as a justified region-specific requirement for this skill file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents itself as an authoritative rule source while simultaneously warning that the content requires manual verification and citing at least one community source. In a policy/RAG context, that mismatch can cause downstream agents or users to over-trust inaccurate compliance guidance, leading to unsafe or noncompliant marketplace content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring and function docstrings are written only in Chinese, which indicates a language-specific constraint in the skill's natural-language guidance. The policy allows locale constraints only when they are optional or clearly justified, and no such opt-in or justification appears here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends user-supplied product data and potentially user-associated identifiers such as user_id, external_id, asin, listing_id, and sku to a remote API via self.harness.run("listing", payload) without any explicit disclosure, consent flow, or minimization guardrails in the CLI. In this skill context, remote transmission is expected for LLM listing generation, but the inclusion of identifiers increases privacy and data-governance risk if operators assume the tool is local-only or pass sensitive business/customer data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The CLI sets --lang to zh by default, which imposes a specific language choice when the user does not explicitly select one. This is a natural-language locale policy concern because the skill does not offer neutral default behavior or require opt-in before using Chinese.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This plain-text template immediately instructs the model to generate Amazon listing copy but does not specify any trigger phrases, activation boundaries, or exclusion conditions for when the template should or should not be used. For prompt-template assets, that lack of trigger specificity can make downstream invocation logic overly broad if this file is used as a general-purpose skill prompt.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing instructions only in Chinese, which can constitute a language/locale policy issue when no opt-in or alternative language is offered. The file does not indicate that the skill is region-specific or otherwise justified to require Chinese-only documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire pricing document is written in Chinese, and the line item for multilingual translation indicates a surcharge, but the file does not state that the content is region-specific or provide any user opt-in for language/locale selection. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Line L257 states this file is an "authoritative rules source," implying reliable, verified guidance. However, earlier content includes questionable absolutes such as search-weight claims and unsupported policy-style assertions (for example L013 and other prescriptive sections) without clear sourcing inline, which conflicts with the file's self-described authoritative status.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency specifier requests>=2.31.0 is unpinned, so installs may resolve to different versions over time and across environments. This weakens reproducibility and can unexpectedly introduce vulnerable or breaking releases into development workflows, especially when combined with a package that has a history of security advisories.
Content: Scanner excerpt · requirements-dev.txt (reported line 3)May include surrounding context.
text
-e ../../packages/tokenapi-sdk -e ../../packages/tokenapi-harness requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: Because requests is not pinned to a specific version, it is impossible to verify from this manifest whether the installed release includes fixes for known advisories or resolves to an affected version. In a dev dependency file this is less severe than a runtime production manifest, but it still creates supply-chain uncertainty and may expose local tooling, tests, or CI jobs to known library flaws.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified as requests>=2.31.0, which allows any newer version to be installed and makes builds non-reproducible. This increases supply-chain risk because a future vulnerable or incompatible release could be pulled in without review, and it also prevents auditors from confirming exactly which version is deployed.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest does not pin the requests version, while the package has multiple known advisories across different releases. Because the installed version is not fixed, it is impossible to verify from this file alone whether deployment will use a vulnerable release, which creates avoidable supply-chain and patch-management risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The top-level natural-language documentation is entirely in Chinese and the usage example defaults to '--lang zh', which can be read as imposing a specific language context. Although the code technically supports multiple locales, the visible user-facing instructions in this file do not offer an explicit language choice or opt-in in the documentation itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code passes lang="zh" directly when composing the listing prompt, and the surrounding natural-language strings and assertions are all Chinese-specific. Under the policy, forcing a specific language without user choice or an explicit documented justification can be a locale-policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.