拼多多返利

• Outcome: Review
• Latest audit: May 28, 2026 · 2:46 PM UTC
• Version: 1.0.1

Overview

This rebate skill mostly matches its stated purpose, but it needs review because it can use local AI API credentials, send shopping text to external services, and handle account balance and withdrawal flows.

Review this before installing. It is intended for a rebate workflow, so backend calls with product links, openId, balance, and withdrawal data are expected. The main risk is that it can also use your workspace AI model API key and send raw shopping messages to the configured model provider. Install only if you trust the publisher and rebate backend, accept the withdrawal flow, and are comfortable with the local OpenClaw model credentials being available to this skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This utility file can load workspace-wide model provider configuration, including API credentials, and send prompts to the configured LLM even though the declared skill scope is limited to authorization/tutorials, rebate links, and product search. In a skill context, undisclosed capability to access external AI services expands the trust boundary and can exfiltrate user data or workspace secrets to third-party endpoints unrelated to the stated purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code reads workspace model provider settings from openclaw.json, selects a provider/model, loads the provider API key, and makes outbound requests to the configured base URL. For a narrowly scoped rebate assistant, this is dangerous because it grants the skill an undeclared capability to use arbitrary external LLM endpoints with workspace credentials, potentially leaking prompts, user content, and sensitive local configuration.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The S01 operation-guide module does more than authorization and tutorials: it performs real account-balance lookups and submits withdrawal requests through backend service calls. This is dangerous because a user-facing guidance skill is effectively granted transactional financial capabilities, increasing the blast radius of prompt-routing mistakes, unintended invocation, or abuse of stored binding state.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The module automatically resumes and executes pending link-rebate or product-search actions after authorization, causing the S01 guide skill to trigger S02/S03 business logic. This cross-scope execution is risky because authorization completion can implicitly launch follow-on actions the user did not freshly confirm, enabling confused-deputy behavior and bypass of intended skill boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The file implements account-balance lookup and withdrawal application functions even though the declared skill scope is limited to three scenarios focused on authorization/tutorials, link rebate conversion, and product search. This creates a capability/scope mismatch that can expose financial actions not clearly disclosed to users or reviewers, increasing the chance of unauthorized or unexpected money movement paths being reachable elsewhere in the skill.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The S03 trigger condition routes any shopping-related expression into product search, which is broad enough to capture ordinary conversation that was not intended as an action request. In this skill context, that can cause unnecessary remote queries and stateful processing tied to a rebate/account workflow, creating privacy and consent concerns rather than just benign misclassification.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Several S01 triggers such as '教程', '返利', or balance/withdrawal phrases are generic enough to collide with normal conversation, causing the skill to enter account or financial flows unexpectedly. Because this skill can check authorization state, query balances, and prepare withdrawals, overly generic triggers increase the chance of unintended sensitive operations or disclosure-oriented responses.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function constructs an Authorization bearer token from the loaded model API key and transmits it to a remote endpoint chosen from configuration, with no visible user-facing disclosure or consent flow. This is dangerous because the skill can silently consume or expose shared workspace credentials and send user/system prompts to third-party infrastructure outside the manifest's stated behavior.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This code sends the user's submitted product link together with a bound account identifier (openId) to multiple backend services for product lookup, adzone lease application, and rebate link generation, but there is no visible consent, notice, or minimization control in this flow. Even if required for business logic, transmitting user-provided URLs and account identifiers without explicit user-facing disclosure increases privacy and data-handling risk, especially because resolved links may expose tracking parameters or shopping intent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The router stores pending authorization requests with the full raw user message before authorization is complete. Because this skill handles shopping links and product queries, raw messages may contain personal data, tracking parameters, or other sensitive content, and there is no visible minimization, consent, retention control, or encryption in this file. In this skill context, the issue is more meaningful because unauthenticated users are explicitly funneled into a flow that persists their pre-auth activity locally.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The applyWithdraw function directly submits a withdrawal request with only openid and amount, and this file shows no built-in confirmation, anti-replay control, or validation that the user has explicitly approved the transfer at the moment of execution. In a skill handling user funds, missing an enforced confirmation barrier makes accidental, spoofed, or improperly triggered withdrawals significantly more dangerous.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends both the raw and cleaned user shopping message to an external model via requestModelJson, and this file shows no notice, consent, minimization, or gating before transmission. Even if the content is 'just shopping text,' users may include personal preferences, budgets, gift targets, or other sensitive details, creating a privacy and data-governance risk when forwarded to a third-party model provider.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code sends the raw user message and a cleaned version to an external model via requestModelJson, which can expose user-provided product queries and any incidental personal or sensitive data contained in them. In this rebate-assistant context, users may paste shopping intents, account-related text, or other free-form content, so undisclosed third-party transmission creates a real privacy and data-governance risk even if it is not a memory-corruption issue.

Static analysis

No suspicious patterns detected.