京东返利

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:35 AM UTC
• Version: 1.0.1

Overview

This is a coherent rebate assistant, but it can submit withdrawal requests and handles sensitive account/model credentials with enough scoping and storage concerns to merit review before installation.

Review this carefully before installing. Use it only if you trust the rebate backend and are comfortable with the skill storing WeChat identifiers locally, generating OpenID-bearing detail links, querying balances, and submitting withdrawals after chat confirmation. Use a restricted model API key for the workspace if possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/http.js:35

Finding

Bearer API Key Forwarded Across Cross-Origin Redirects

Content

View full analysis

0) { try { const nextUrl = new url_1.URL(location, target).toString(); const redirected = await requestText(nextUrl, { method: statusCode === 303 ? "GET" : method, headers: requestHeaders, body: statusCode === 303 ? undefined : body, timeoutMs, insecure, maxRedirects: maxRedirects - 1, }); resolve(redirected); } ``` ### Technical Analysis The model API request contains a bearer credential in the `Authorization` header. The shared HTTP client follows redire ...[truncated 1630 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/common.js:176

Finding

Sensitive Authentication and Withdrawal State Stored Without Explicit Restrictive Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/m01OperationGuide.js:209

Finding

WeChat OpenID Exposed in User-Facing Query-String URLs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented S01 scope sounds like guidance and tutorials, but the finding indicates the implementation can perform real withdrawal application and balance/detail retrieval. In a financial/rebate context, understating transactional capability is dangerous because it may lead operators or users to treat a state-changing flow as harmless informational content, weakening scrutiny around consent, confirmation, and authorization.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/common.js (reported line 550)May include surrounding context.

js

if (!state.requests || !state.requests[machineCode]) {
        return;
    }
    delete state.requests[machineCode];
    saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state);
}
function loadPendingWithdrawState() {

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/common.js (reported line 599)May include surrounding context.

js

if (!state.requests || !state.requests[machineCode]) {
        return;
    }
    delete state.requests[machineCode];
    saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state);
}
function loadPendingWithdrawState() {

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/common.js (reported line 613)May include surrounding context.

js

if (!state.requests || !state.requests[machineCode]) {
        return;
    }
    delete state.requests[machineCode];
    saveJsonFile(exports.PENDING_AUTH_REQUEST_PATH, state);
}
function loadPendingWithdrawState() {

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says this skill only works in three scenarios and describes S01 as '授权与教程', while S02 handles rebate links and S03 handles product search. In this file, the action map and handlers implement additional operational capabilities under S01-like triggers: querying account balance, generating rebate-details links, preparing withdrawals, and actually submitting withdrawal requests, which is materially broader than authorization/tutorial guidance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code directly initiates a financial withdrawal via applyWithdraw(openId, amount) based only on chat-driven state and a generic “确认提现” step, without any visible strong re-authentication, anti-CSRF/anti-replay protection, or explicit proof-of-user-presence beyond local pending state. In a chat-integrated skill, that creates a meaningful risk of unauthorized or manipulated fund transfers if session state is confused, the device/machine binding is abused, or another actor can trigger confirmation on the user’s behalf.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/recognizePreciseProductSearch.js (reported line 786)May include surrounding context.

js

if (modelValue && ruleValue) {
        if (preferSpecific) {
            if (GENERIC_ONLY_TERMS.has(modelValue) && !GENERIC_ONLY_TERMS.has(ruleValue)) {
                return ruleValue;
            }
            if (ruleValue.length > modelValue.length && ruleValue.includes(modelValue)) {
                return ruleValue;

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/recognizePreciseProductSearch.js (reported line 789)May include surrounding context.

js

if (modelValue && ruleValue) {
        if (preferSpecific) {
            if (GENERIC_ONLY_TERMS.has(modelValue) && !GENERIC_ONLY_TERMS.has(ruleValue)) {
                return ruleValue;
            }
            if (ruleValue.length > modelValue.length && ruleValue.includes(modelValue)) {
                return ruleValue;

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation advertises shell, network, and environment-backed scripts but does not declare any explicit tool scope or permissions boundary. In an agent environment, that omission can lead to overbroad execution privileges, making it easier for the skill to invoke external commands or access sensitive runtime context beyond what is necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description and all documented trigger phrases and outputs are specified only in Chinese, indicating a fixed locale behavior. There is no indication that users can opt into another language or that the locale restriction is a documented, justified regional limitation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Very broad triggers such as “教程” or “返利” can cause the skill to activate on incidental conversation, which is especially risky here because the skill can reach authorization, balance, withdrawal, and rebate-processing flows. Unintended activation can expose account-related prompts, trigger sensitive backend lookups, or steer a conversation into financial operations the user did not intend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The rule 'no link but expresses shopping intent' is vague and can over-trigger product search or routing on ordinary conversation. In this skill, ambiguous routing matters because it can cause unnecessary external API calls, incorrect platform assumptions, or movement into rebate-generation workflows without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This routing table recognizes only Chinese natural-language inputs such as "返利", "教程", and "我要提现". The file does not indicate any user opt-in, alternative locale support, or documented justification for restricting invocation to Chinese, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The rebate API helper serializes request payloads and sends them to external endpoints, and the model request function later transmits system and user prompts to a remote service. This file does not include any user-facing notice, confirmation, or explanatory comments warning that local data and prompts may be transmitted off-box.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes a rebate assistant operating in three constrained scenarios, but this file introduces subprocess execution via spawnSync to invoke curl for both rebate API requests and arbitrary URL fetching. Executing external programs is a materially broader capability than ordinary HTTP requests and is not declared or justified by the manifest’s stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This utility file includes a generic LLM invocation path that can load workspace model settings and send arbitrary prompts to a remote chat completion endpoint, which exceeds the skill’s declared three rebate-only scenarios. In an agent skill, hidden general-purpose model-calling capability expands data exfiltration and prompt-injection attack surface because other code can route user or system data to an external model without being obviously tied to the stated functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code reads workspace-wide model provider configuration, including base URLs and API keys, from openclaw.json even though the skill description does not justify needing access to global model credentials. Access to broader workspace secrets from a narrowly scoped rebate skill violates least privilege and creates a pathway for misuse of shared credentials or unintended disclosure through later network calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code loads a model API key from workspace configuration and uses it to send prompts to an external endpoint without any visible user-facing disclosure or consent flow in this file. In a rebate assistant context, undisclosed third-party processing of user/system prompts is risky because users would not expect their content to be relayed to a model provider outside the declared rebate workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.