Ow

• Outcome: Review
• Latest audit: May 28, 2026 · 2:24 PM UTC
• Version: 2.3.4

Overview

The skill mostly matches a procurement workflow, but it needs review because it can publish business data externally, stores sensitive bid/payment-related data locally, and has weak scoping around destinations and file paths.

Install only if you are comfortable with procurement requests, supplier bids, contacts, pricing, agent identifiers, and local notification records being stored in the skill directory and sent to the configured OW endpoint. Set OW_API_URL only to a trusted HTTPS service, avoid broad auto-activation, review or remove bundled state data before use, and run it in a constrained workspace until URL validation, path validation, and retention controls are added.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tainted flow: 'req' from os.environ.get (line 140, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST"
        )
        
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode('utf-8'))
            if result.get("success"):
                return {"success": True, "platform": "OW社区", "post_id": result.get("post_id")}

• Confidence: 96% confidence
• Finding: The OW API endpoint is sourced from the OW_API_URL environment variable and then used directly in urllib.request.urlopen, allowing outbound requests to an attacker-controlled destination if the environment is compromised or misconfigured. Because the request includes user-supplied procurement content and agent identifiers, this creates an SSRF/exfiltration path rather than a harmless configuration choice.

Tainted flow: 'req' from os.environ.get (line 70, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST"
        )
        
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode('utf-8'))
            if result.get('success'):
                requirement["published"] = True

• Confidence: 95% confidence
• Finding: The request destination is taken from the OW_API_URL environment variable and used directly in urllib.request.urlopen without validation or allowlisting. If an attacker can influence the environment, they can redirect procurement data to an arbitrary host, causing data exfiltration or unexpected outbound requests; the fact that this code publishes buyer identifiers and request content makes the sink materially sensitive.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes broad everyday terms such as procurement-related words that can appear in normal conversation, increasing the chance of accidental activation. In this skill, accidental invocation is more dangerous because activation may lead to publishing requests externally, storing local data, or initiating notifications and cross-platform posting workflows without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The example invocations are phrased as natural language requests without a strong activation delimiter, which can cause the system to treat ordinary user conversation as an instruction to start a procurement workflow. Given the skill's context of external publication and bid collection, unclear activation boundaries materially raise the risk of unintended data disclosure or unintended outbound actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script automatically notifies another component after evaluation by default, which can disclose procurement outcomes and associated bid details to a separate module without an explicit user confirmation at the action point. In an agent-skill context, hidden cross-component actions are more dangerous because they can trigger unintended data sharing or side effects during what appears to be a local scoring operation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script sends procurement content, agent_id, and agent_name to a remote service immediately when the OW platform is selected, without any explicit confirmation, preview gate, or disclosure of the destination. In an agent/skill context, silent outbound transmission increases the risk of unintended data leakage, especially if product requests contain sensitive business or personal information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script automatically transmits procurement details, buyer name, and buyer ID to a remote API as part of normal execution, but gives no explicit user-facing notice or confirmation that external network transmission will occur. In agent or automation contexts this can leak operational or potentially sensitive business information to third parties without informed consent, especially since the remote endpoint is configurable.

Static analysis

No suspicious patterns detected.