dmp-persona-insight

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.2

Overview

The skill’s DMP persona-analysis purpose is coherent, but it includes unsafe API integration guidance and code that expose real-looking credentials and disable TLS verification.

Review before installing. Do not use this version with real DMP credentials unless the publisher removes and rotates the exposed AK/SK examples, enables TLS verification, removes curl -k and verify=False guidance, and documents how uploaded audience data and generated reports are handled. Use OpenClaw secret configuration or a secrets manager, not chat, for credentials.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/insight-integration.md:98

Finding

Hardcoded DMP Access and Secret Keys Exposed in Documentation

Content

View full analysis

Remediation

View remediation

' export DMP_SK='' ``` 4. Remove the credentials from the current repository and purge them from version-control history. Merely editing the latest revision is insufficient. 5. Remove real signatures, task IDs, and other production-derived authentication examples. 6. Add automated secret scanning to pre-commit hooks and the Skill publication pipeline. 7. Store credentials in the OpenClaw secret configuration or a dedicated secret manager and inject them only into the process that requires API access. 8. Apply least-privilege API permissions and use separate, short-lived credentials for development, testing, and production. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/insight_api.py:57

Finding

TLS Certificate Verification Disabled for Authenticated DMP Requests

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (50)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose centers on persona insight analysis, but the described behavior also includes local file processing and PPT generation, which materially expands what the skill can read, write, and persist. This mismatch is dangerous because users and orchestration layers may grant trust or invoke the skill under assumptions that do not reflect its real operational footprint.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-integration.md (reported line 192)May include surrounding context.

logger.info(f"API key: {api_key}")

错误：在版本控制中提交密钥

.env 或 config.py 文件包含真实 API key

text

## 配置验证

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide normalizes suppressing SSL warnings and disabling certificate validation in example code, which trains consumers to bypass TLS protections. This enables man-in-the-middle interception or tampering of requests carrying authentication parameters and API responses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation includes hard-coded, real-looking AK/SK values in code and configuration examples. Even if intended as samples, users may copy them into production code, commit them to version control, or mistake them for valid shared credentials, creating credential exposure and unauthorized API access risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The direct HTTP examples explicitly use curl -k and requests verify=False without warning, weakening transport security for authenticated API calls. Because the requests include access credentials and signed parameters, interception or response tampering could expose sensitive data and undermine trust in the integration.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The curl example demonstrates an unsafe parameterization pattern by combining authenticated API access with -k, which disables server certificate verification. In this context, the skill is specifically for marketing/persona data integrations, so users are likely to run the command against real services and expose signed requests or receive attacker-controlled responses.

Content

Scanner excerpt · references/insight-integration.md (reported line 160)May include surrounding context.

bash

# 获取洞察结果
curl -s "https://dmp-dev.mingdata.com/api/open-api/audience/insight/result?ts=1774580142&randStr=8165&accessKey=wArzwWvT&sign=5A4E951BCCF371F48FDFA39BF2D53A25&taskId=100262" \
  -k | jq .

# 或使用 Python requests

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide tells users to paste DMP_AK and DMP_SK directly into natural-language chat, which is unsafe because chat transcripts are often logged, retained, exported, or visible to operators and downstream systems. Secret keys provided this way can be exposed through conversation history, monitoring tools, prompt injection side effects, or accidental reuse in later responses.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file describes the integration as 'correct' and compatibility-optimal, yet later disables TLS certificate verification for HTTPS requests. This mismatch can mislead operators into trusting an insecure configuration, enabling man-in-the-middle interception or tampering of API traffic carrying authentication parameters and returned insight data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The client sends accessKey, timestamp, random string, and signature over HTTPS while certificate verification is disabled. An attacker positioned on the network could impersonate the API endpoint, capture authentication material, and tamper with responses, undermining confidentiality and integrity of the integration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises capabilities that require environment access, file I/O, and network access, but it does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and can allow the skill to access secrets, local files, or external endpoints more broadly than users would reasonably expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger words and use conditions are very broad and overlap with common analytical requests, increasing the likelihood of accidental invocation. In this context, mis-triggering is more concerning because the skill can access DMP credentials, local files, and external APIs, so an unintended activation could process sensitive data or initiate external transfers without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill handles uploaded data, uses AK/SK to call an external DMP API, and generates reports/PPT artifacts, yet it provides no clear privacy, retention, or data-handling notice. In a persona-insight context, the data is likely marketing or audience-profile data that may be sensitive or regulated, so missing disclosure and safeguards materially increase privacy and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L011-L018 明确说明主排序应按 TGI 从高到低，且 L357 也再次声明“按 TGI 降序，占比作为次排序”。但 L064-L068 的实现逻辑只使用 coverage 进行排序，没有体现 TGI 主排序，和文档自述算法直接矛盾。这会导致技能声称采用的核心特征筛选标准与实际实现示例不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file title and the entire instructional content are written exclusively in Chinese, indicating a fixed language/locale for the skill's analysis framework. There is no natural-language indication that users may choose another language or opt in to Chinese output, which can violate the language/locale policy for skills that force a specific language without user choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 35)May include surrounding context.

md

"Content-Type": "application/json"
}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 35)May include surrounding context.

md

"Content-Type": "application/json"
}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 36)May include surrounding context.

md

}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,
    timeout=30

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 61)May include surrounding context.

md

}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,
    timeout=30

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 160)May include surrounding context.

md

}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,
    timeout=30

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 219)May include surrounding context.

md

}

response = requests.post(
    "https://api.mingdata.com.cn/audience/analyze",
    json={"audience_id": "12345"},
    headers=headers,
    timeout=30

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-integration.md (reported line 61)May include surrounding context.

md

fi

# 调用 API
curl -X POST https://api.mingdata.com.cn/audience/list \
  -H "Authorization: Bearer $DMP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"limit": 10}' \

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire guide, examples, headings, and operational instructions are written exclusively in Chinese, with no indication that the skill can operate in other languages or that Chinese is an intentional opt-in or region-specific requirement. Under the policy, a skill that imposes a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is entirely framed as a strict formatting guide in Chinese and repeatedly requires analyses to follow that exact format, but it does not indicate that Chinese is optional or limited to a region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document shows realistic AK/SK values in both code and environment-variable examples without clear warnings that the values are sensitive secrets. In a skill meant for integration and automation, this increases the likelihood of secret leakage through copy-paste, screenshots, logs, and repository commits.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Setting verify=False establishes an unsafe default in example client code and encourages downstream consumers to adopt it unchanged. This is especially risky here because the code accesses external APIs with authentication data and may process potentially sensitive audience-insight results over a connection that can be intercepted.

Content

Scanner excerpt · references/insight-integration.md (reported line 177)May include surrounding context.

'taskId': '100262' }

response = requests.get(url, params=params, verify=False) print(response.json())

text

Static analysis

No suspicious patterns detected.