1688-88syt

• Outcome: Review
• Latest audit: May 28, 2026 · 7:04 AM UTC
• Version: 0.2.0

Overview

This skill matches its 1688/88生意通 transaction purpose, but it handles a powerful access key unsafely and can perform real business state changes that deserve careful review.

Install only if you intend to let this skill act on real 1688/88生意通 transactions. Do not paste production Access Keys into normal chat; rotate any key already shared, prefer a secure secret store or environment injection, and require explicit human review before creating, signing, rejecting, invalidating, confirming receipt, or requesting refunds.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tainted flow: 'gateway_url' from os.environ.get (line 33, credential/environment) → requests.patch (network output)

Critical

• Category: Data Flow

Content

headers = {}
        if token:
            headers["Authorization"] = f"Bearer {token}"
        resp = requests.patch(f"{gateway_url}/api/config",
                              headers=headers, json=payload, timeout=5)
        return resp.ok
    except Exception:

• Confidence: 94% confidence
• Finding: The code sends the API key payload and optional bearer token to a URL taken directly from the OPENCLAW_GATEWAY_URL environment variable, with no validation of scheme, host, or trust boundary. If that environment variable is influenced by an attacker or misconfigured, credentials can be exfiltrated to an arbitrary remote server; the default of plain HTTP also weakens transport security.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill invokes a local Python CLI, reads reference files before execution, depends on an environment secret (SYT_API_KEY), and performs network-backed business actions, yet it does not declare corresponding permissions. This creates a trust and review gap: operators and policy layers cannot accurately assess or constrain what the skill can access, especially for financial transaction workflows.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The README explicitly tells users to paste their Access Key into the AI chat, which exposes a sensitive credential to the model runtime, chat logs, and any downstream tooling that may process conversation content. In this skill's context, the AK is the authentication secret for performing real B2B transaction actions such as creating orders, signing, confirming receipt, and requesting refunds, so credential disclosure could enable unauthorized account actions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger conditions are broad enough to activate on common words such as refunds, receipt confirmation, real-name verification, binding cards, buyer/seller questions, and related business terms. In a skill that can create orders, sign, invalidate, confirm receipt, and request refunds, overbroad matching raises the chance of unintended invocation and accidental progression into high-impact transactional flows.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs users to paste their Access Key directly into chat, which exposes a sensitive credential to the conversational channel, logs, and any downstream processing of chat content. Because this AK appears to authorize B2B transaction-related actions, compromise could enable unauthorized account access or transaction operations, making the context especially sensitive.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger examples include broad natural-language phrases such as “确认采购单” and “签约” for a write operation that performs legally and financially meaningful order signing. In this skill’s B2B transaction context, ambiguous utterances can cause unintended execution of a procurement-signing action, especially if an agent maps casual confirmation language directly to this capability.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The rule mandates Chinese-only responses for all users, without accounting for user language preference or accessibility needs. In a financial/transactional skill handling contracts, refunds, receipt confirmation, and identity/bank-binding workflows, forcing a single language can cause users to misunderstand high-risk actions or consent prompts, increasing the chance of mistaken authorization or failed comprehension.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This function directly performs a state-changing, potentially irreversible confirm-receipt API call as soon as it is invoked, with no in-function safeguard such as a confirmation token, dry-run mode, or explicit acknowledgment requirement. In a transactional B2B skill handling procurement and fund-release flows, accidental or manipulated invocation could prematurely acknowledge delivery and affect dispute/refund rights or release downstream business processes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function performs a destructive state-changing action that marks a purchase order invalid immediately after receiving a draft number, with no built-in confirmation, acknowledgment of consequences, or secondary verification in this code path. In a transaction-management skill handling contracts, refunds, and receipt confirmation, this increases the risk of accidental or socially engineered invalidation of legitimate orders.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This function directly triggers a procurement-order signing API using only a provided draft number, with no built-in confirmation step, re-authentication, or evidence of user-intent verification in this code path. In a B2B trading skill, signing a purchase order is a high-consequence state-changing action that can bind parties to financial or contractual obligations, so accidental, coerced, or prompt-injected invocation could cause unauthorized commitments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This function directly performs a state-changing sign-rejection action against a procurement contract using only a provided draft number, with no confirmation, secondary verification, or visible authorization guard in this code path. In a B2B contract workflow, accidental or induced invocation could cancel or disrupt a signing process, causing business loss, dispute, or workflow sabotage; the surrounding skill context increases the risk because it is explicitly designed to execute high-impact transaction operations from simple user instructions.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: Instructing users to disclose an Access Key directly in chat is a real secret-handling flaw, not just a documentation issue. Because this skill interfaces with account status, procurement orders, signatures, receipt confirmation, and refunds, a leaked AK could let an attacker or improperly scoped system impersonate the user and manipulate business transactions or access sensitive account data.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The documented workflow tells the agent to extract the Access Key from the user's message and pass it on the command line to `cli.py configure <AK>`, creating multiple exposure points beyond chat itself, including shell history, process listings, telemetry, and logs. In a skill handling contracts, refunds, confirmations, identity, and bank-binding workflows, leaked credentials could have serious financial and account-security consequences.

Static analysis

No suspicious patterns detected.