商业捡漏预警虾

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This is a coherent deal-alert demo skill that stores local alert history and suggests optional Feishu or cron use, with no evidence of hidden exfiltration, destructive behavior, or privilege escalation.

Install only if you are comfortable with a Chinese-language demo skill that writes local monitoring logs under the OpenClaw workspace. Before enabling real scraping, Feishu notifications, or cron, confirm the platforms, login/session use, recipients, schedule, and retention of alert data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description largely matches the domain and intent: the code is indeed for discovering potentially undervalued listings/opportunities across resale, housing, auctions, and procurement, and it includes discount calculation and basic risk assessment. However, there are material gaps between the declared behavior and the actual implementation. The most significant mismatch is alert delivery: the description explicitly says it pushes Feishu alerts, but the code only logs locally and prints to stdout. The code also performs single-run scans from a config/rule rather than persistent or first-time monitoring. Additionally, the fetching logic is explicitly marked as demo/sample data, so the promised cross-platform monitoring is not actually implemented. Finally, several platforms are declared/listed but not actually supported by the main dispatch logic. These are substantive functionality mismatches, not merely implementation details.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill instructs reading local reference files, writing rule/config files under the workspace, and invoking a local Python script, but it declares no explicit tool scope or permissions. This creates an authorization gap where the runtime may permit broader file/env access than users expect, reducing transparency and increasing the chance of unintended local data exposure or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad terms like '抢先', '套利', '优质标的', '帮我盯着XXX', and '监控XXX平台', which can match ordinary conversation and activate the skill unexpectedly. Unintended activation is risky here because the skill is designed to build monitoring rules, read/write local files, and potentially set up recurring scans or outbound notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes outbound Feishu alerts and optional scheduled background monitoring without a clear upfront warning or consent flow. In this context, silent outbound messaging or persistent cron-based execution can surprise users, leak monitored content to third-party services, or create ongoing activity the user did not fully authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly defines collection of contact information and relies on login-state-dependent scraping, then stores monitoring results locally without any stated privacy controls, minimization rules, retention limits, or consent boundaries. In a deal-monitoring context spanning real-estate, second-hand marketplaces, and procurement sites, this creates real risk of collecting and retaining personal or account-linked data unnecessarily, which could expose sensitive information if mishandled or leaked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The entire skill reference content is written only in Chinese, with no indication that users may choose another language or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains only Chinese-language instructions and labels, and there is no natural-language indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule, forcing a specific language without opt-in is a reportable locale/language policy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level docstring describes the script's output as JSON printed to stdout, which implies a transient command-line reporting behavior. In practice, the code also creates a data directory, writes deduplication state to seen_ids.json, and appends every alert to alerts_log.jsonl, adding persistent side effects not disclosed in the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently persists monitoring history and alert content under the user's home/workspace directory, which can expose potentially sensitive searches, deal targets, URLs, and business intelligence without clear user consent. In this skill context, the monitored data may reveal acquisition strategy, investment interests, or procurement opportunities, so undisclosed retention is more sensitive than in a generic utility script.

Content

No source excerpt is available for this finding.

Tainted flow: 'ALERTS_LOG' from os.environ.get (line 28, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/monitor.py (reported line 55)May include surrounding context.

python

SEEN_IDS_FILE.write_text(json.dumps(list(seen)))

def log_alert(alert: dict):
    with open(ALERTS_LOG, "a") as f:
        f.write(json.dumps(alert, ensure_ascii=False) + "\n")

def make_id(platform: str, item_id: str) -> str:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill metadata and operating instructions are presented entirely in Chinese and imply a Chinese-language interaction model, but the file does not offer a language choice or explain that the skill is intentionally limited to a Chinese-only region or audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

All user-facing natural-language content in the file is presented only in Chinese, with no indication that another language can be selected or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The docstring states that matching items are printed to stdout in JSON format, but main() defaults to --output text and prints formatted alert messages instead. It also logs alerts to disk, so the documented output behavior actively differs from what the code normally does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

When --config is provided, the script reads and parses a user-supplied JSON file from disk, but the usage text does not explicitly disclose this file access behavior. For a safety audit, local file access should be clearly described so users understand what inputs are consumed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.