T09 · Insecure Skill Coding Practices
Error
- Location
scripts/capabilities/configure/service.py:33- Finding
Credential Exfiltration Through an Unrestricted Gateway URL Override
- Content
View full analysis
- Remediation
View remediation
Security audit
1688-88syt
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its 1688 transaction-management purpose, but it needs Review because it handles a powerful access key insecurely and can perform real financial or business state changes.
Install only if you trust the publisher and need an agent to manage 1688 88 生意通 transactions. Treat the AK as a sensitive secret, prefer a platform secret store over chat or command-line entry, verify OPENCLAW_GATEWAY_URL points only to the trusted local gateway, lock down ~/.openclaw/openclaw.json permissions, and require explicit confirmation before any create, sign, receipt-confirmation, invalidation, or refund action.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/capabilities/configure/service.py:74- Finding
Plaintext Access Key Stored Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/capabilities/configure/cmd.py:39- Finding
Access Key Exposed Through Command-Line Arguments and Conversation Instructions
- Content
View full analysis
`. 2. The credential is retained in chat history, shell history, process metadata, or execution logs. 3. An attacker or unauthorized operator gains read access to one of those records. 4. The attacker extracts the AK. 5. The attacker uses it to sign API requests within the credential's authorized scope. ### Impact Assessment Credential compromise may expose account and contract information and may permit transaction-changing actions associated w ...[truncated 229 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/_http.py:69- Finding
Raw Gateway Error Responses Printed to the Public Output Channel
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (55)
Tainted flow: 'gateway_url' from os.environ.get (line 33, credential/environment) → requests.patch (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The code sends a configuration PATCH request to a URL taken directly from the OPENCLAW_GATEWAY_URL environment variable, defaulting to plain HTTP. If that variable is manipulated to point to an attacker-controlled or non-TLS endpoint, the API key and optional bearer token can be exfiltrated over the network. In a credential-configuration skill, this is especially sensitive because the whole purpose of the flow is handling secrets.
- Content
python headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch(f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5) return resp.ok except Exception:
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
If the implementation performs local configuration writes and networked credential use that are absent from the main description, users may be socially engineered into granting or providing credentials under the belief that the skill is only a business-process helper. In a financial transaction context, undisclosed credential-handling behavior materially increases risk because those credentials may authorize sensitive queries or state changes.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs users to paste their Access Key into chat, which exposes a sensitive credential in conversation history, logs, and any downstream observability systems handling agent messages. In a financial/B2B transaction skill, this is especially dangerous because the key likely enables account-linked actions such as contract, refund, receipt confirmation, or payment-related operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs downstream users to comply with a '中文输出' requirement. This is a natural-language locale policy constraint, and the file does not indicate that users may choose another language or opt in to Chinese-only behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README promotes high-impact business operations like signing, confirming receipt, invalidating orders, and applying refunds through natural-language commands but does not clearly warn that these actions may be irreversible or financially consequential. In this B2B transaction context, lack of friction or explicit confirmation guidance increases the risk of accidental or socially engineered execution of legally and commercially significant actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explicitly instructs users to paste their Access Key directly into the AI chat, which exposes a sensitive credential to the model, platform logs, prompt history, and any downstream tool integrations. In a skill that can create orders, sign documents, confirm receipt, invalidate orders, and request refunds, compromise or mishandling of the AK could enable unauthorized business actions and account abuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill invokes a local Python CLI, reads reference files, uses an environment secret (SYT_API_KEY), and appears capable of networked business actions, yet it declares no explicit tool scope or permission boundaries. In a skill that can create orders, sign documents, confirm receipt, or request refunds, missing least-privilege constraints increases the chance of unintended file access, secret handling issues, or unauthorized state-changing operations if the agent is induced to execute commands.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough to activate on many common business terms such as buyer, seller, refund, or real-name verification, which can cause the wrong skill to engage in unrelated contexts. Because this skill includes high-risk transactional actions and credential setup guidance, over-triggering raises the chance of accidental invocation, inappropriate data collection, or unintended state-changing suggestions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The common-rules reference is described as containing a hard requirement for '对客中文', meaning customer-facing responses must be in Chinese. This is a language policy constraint presented as mandatory, with no indication that the user may choose another language or opt in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document not only asks the user to reveal the Access Key in chat, but also instructs the agent to extract that secret from the message and pass it on the command line to a local process. This creates multiple exposure points: chat retention, agent memory, process arguments visible to system tooling, shell history/logging, and possible leakage through error reporting.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The capability maps broad natural-language phrases such as '签署采购单', '确认采购单', and especially generic '签约' to a write operation that performs an actual procurement-order signature. Because signing is a state-changing, high-consequence business action, overly broad triggers increase the risk of accidental invocation, misrouting from ambiguous user intent, or prompt-injection-style steering into an unintended transaction approval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction '仅使用中文' forces a specific language for all user-facing content unless the user explicitly asks for technical details, but it does not offer a general language choice or opt-in. This is a natural-language policy issue because it imposes a locale/language constraint by default rather than allowing user preference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese and provides no indication that language choice is optional or that the locale is intentionally constrained for a region-specific skill. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module's docstrings and all user-facing error strings are written only in Chinese, indicating the skill enforces a specific language in its output. The policy allows locale constraints only when users are given a choice or when the restriction is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring and command description are written only in Chinese (e.g. "账号查询命令" and "查询账号信息"), and the user-facing error message is also Chinese-only. This imposes a specific language on users without any opt-in, fallback, or documented regional justification, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The module docstring, error messages, and generated markdown are all written in Chinese, with no indication that the user can choose another language or locale. This is a natural-language policy concern because it forces a specific language experience without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s docstring, command description, and generated user-facing status messages are all hard-coded in Chinese. This appears to enforce a specific language for the skill’s interaction without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function transmits the provided API key to the gateway without enforcing transport security and without surfacing any disclosure or consent to the user. Because the default URL is http://localhost and the endpoint can be overridden by environment variable, secrets may be exposed via local interception, proxying, container/network boundary issues, or redirection to a remote host.
- Content
Static analysis
No suspicious patterns detected.