ClawHub
Back to skill

Security audit

唯品会活动搜索

Security checks for vulnerabilities and agentic risk

Overview

This Vipshop promotion skill has a legitimate shopping-purpose workflow, but it automatically reads account tokens, sends an authenticated request, and can install or execute another login skill without a clear user approval boundary.

Review this skill before installing. It should only be used if you are comfortable with an agent reading Vipshop login tokens from your home directory, sending an authenticated request to Vipshop, and potentially installing or running a separate login skill. Prefer a version that requires explicit approval before login, pins the login dependency, and scopes file and network access clearly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:51
Finding

Automatic Installation and Execution of an Unpinned External Skill

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the AI to install another skill and execute subprocess commands automatically without a clear upfront warning or consent for system modifications. That is dangerous because it can alter the environment and run additional code under the guise of a simple user query, violating user expectations and increasing attack surface.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs execution of a Python script from a sibling skill directory, which is cross-skill code execution outside the declared promotion-search function. This bypasses clear trust boundaries and can execute code that was not reviewed as part of this skill, potentially accessing credentials or performing unintended actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill performs sensitive capabilities—reading login state from the user's home directory and calling an external API—but does not declare an explicit tool or permission scope. That weakens least-privilege boundaries and makes it harder for a host system or reviewer to understand and constrain what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger scope is overly broad and claims overlap with generic shopping or promotion queries across multiple platforms, increasing the chance of unintended invocation. In this skill's context, accidental activation is more dangerous because activation can lead to token-file access, external requests, and even installation/execution of another skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The overview repeats ambiguous activation conditions without defining when the skill must not run. Because this skill includes privileged behaviors like reading login artifacts and initiating login flows, ambiguous routing materially increases the risk of unnecessary sensitive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill reads a login token file from the user's home directory without a clear privacy disclosure or consent step. Accessing authentication material is sensitive even if only checking existence/validity, and in this context it may happen automatically on broad triggers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to automatically install another skill via clawhub as part of normal execution. Auto-installing code changes the system state and extends trust to unreviewed external content, creating a supply-chain and arbitrary capability expansion risk beyond a simple promotion lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill does not clearly warn users that it sends requests to an external Vipshop API and may use authenticated session data. In a login-dependent workflow, omission of this disclosure can lead to users unknowingly authorizing external transmission tied to their account context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
- 未登录时提示用户先登录

### 促销活动接口
**URL：** `https://api.union.vip.com/vsp/common/getActListForAI`
**方式：** POST
**请求体：** 空对象 `{}`
**返回：** code, msg, data.actList[]

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill reads persisted login material from the user's home directory and uses it to perform network requests, but the manifest only describes promotion lookup behavior and does not disclose access to local authentication state. This creates an authorization-boundary and privacy issue because a seemingly simple query skill can silently leverage account credentials without explicit user awareness or scoped consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code loads stored cookies, extracts PASSPORT_ACCESS_TOKEN, and transmits it to a remote service with no user-facing confirmation or runtime warning. Even if sent to a legitimate vendor endpoint, silently exfiltrating authentication tokens from local storage can expose account-linked data and normalize unsafe credential-handling patterns if the endpoint, environment, or logs are compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill transmits data to an external service, including a login-derived access token, which is security-relevant because the network call crosses the local trust boundary. External transmission is expected for a promotion-query skill, but the danger is elevated here because authentication material from local storage is included rather than using an isolated application credential or anonymous request.

Content

Scanner excerpt · scripts/promotion_search.py (reported line 164)May include surrounding context.

python
cookies['PASSPORT_ACCESS_TOKEN'] = login_cookies['PASSPORT_ACCESS_TOKEN']

    # API 接口
    url = "https://api.union.vip.com/vsp/common/getActListForAI"

    # 调用接口
    response = make_request(url, cookies=cookies, post_data={})

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

Most of the file repeatedly mandates automatic login initiation without waiting for user action, but the '登录态要求' section states '未登录时提示用户先登录'. These instructions describe different intended behaviors, creating an internal intent mismatch in the skill documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Accept-Language header is fixed to 'zh-CN,zh;q=0.9,en;q=0.8', which imposes a locale preference in network interactions. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy concern unless the restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.