ClawHub
Back to skill

Security audit

唯品会活动搜索

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Vipshop promotion lookup tool, but it can automatically install and run a separate login skill and use local account tokens without clear user approval.

Review before installing. Use this skill only if you are comfortable with an agent checking local Vipshop login state, sending a Vipshop access token to Vipshop's API, and potentially installing/running a separate login skill. Prefer a version that asks before login, pins and verifies the login dependency, and limits activation to explicit Vipshop requests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:45
Finding

Automatic Installation and Execution of an Unpinned Authentication Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-64; repeated at lines 226-237
Vulnerability Type: Untrusted and unpinned third-party dependency installation
Risk Level: High

Vulnerable Code

bash
clawhub install vipshop-user-login
bash
python3 ../vipshop-user-login/scripts/vip_login.py --blocking

The Skill instructions require the agent to install vipshop-user-login automatically when it is unavailable and then invoke that Skill or execute its login script. No immutable version, cryptographic digest, trusted publisher identity, or package integrity check is specified.

Technical Analysis

Installing a dependency by a mutable package name and immediately executing it creates a supply-chain trust boundary that is not adequately controlled. The effective code executed during the login process can change after this Skill has been audited.

The risk is heightened because:

  • Installation is automatic rather than explicitly approved by the user.
  • The dependency is not pinned to a reviewed version or immutable digest.
  • No package signature, checksum, publisher identity, or source repository is verified.
  • The fallback directly executes a Python file supplied by the external Skill.
  • The dependency participates in an account authentication flow and may access or create sensitive login credentials.
  • The instructions require execution to continue automatically after installation.

This behavior exceeds minimum privilege for a promotion lookup. A safer implementation could stop and request informed consent when the audited authentication dependency is unavailable, rather than downloading and executing mutable third-party code automatically.

The network behavior in scripts/promotion_search.py was also reviewed. It reads ~/.vipshop-user-login/tokens.json, extracts PASSPORT_ACCESS_TOKEN, and transmits that token over HTTPS only to the declared Vipshop API endpoint. No evi ...[truncated 1899 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin vipshop-user-login to an explicitly reviewed, immutable version and cryptographic digest.
  2. Verify the package signature, checksum, expected publisher identity, and trusted source before installation or execution.
  3. Require explicit, informed user approval before downloading or running a missing authentication component.
  4. Do not fall back to executing a relative Python script unless its resolved path, ownership, permissions, version, and integrity have been validated.
  5. Vendor a reviewed authentication component when licensing and maintenance requirements permit, or use a trusted dependency lock file with hash enforcement.
  6. Run the authentication component in a restricted environment with minimal filesystem and network access.
  7. Limit credential-file permissions and expose only the minimum authentication material needed for the declared API request.
  8. Fail safely when the required verified version is unavailable instead of installing the latest package by name.
  9. Record and display the exact package version, digest, source, and requested permissions before execution.
  10. Re-audit the authentication dependency independently because it handles sensitive credentials and executes outside the reviewed project.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger description is overly broad and claims overlap with general shopping queries across multiple platforms, increasing the chance the skill is invoked in contexts the user did not intend. In this skill, unintended invocation is more dangerous because invocation can lead to token-file checks, automatic login attempts, and external network activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the agent to install another skill and run subprocesses automatically without a clear, explicit warning that the system will be modified and additional code executed. This deprives the user of informed consent and introduces significant supply-chain and execution risk under the guise of a simple data-query task.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill performs sensitive capabilities—reading local token files and making network requests—but does not declare any explicit tool scope or permission boundaries. This weakens containment and review, making it easier for the skill to access local authentication material and external endpoints without clear authorization expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The usage guidance defines activation in broad, ambiguous terms without clear boundaries or exclusions, which can cause accidental activation. Because this skill performs account-state checks and may trigger login handling, ambiguous activation materially increases privacy and autonomy risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill mandates automatic login triggering without a fresh user request, causing the agent to initiate an authentication workflow and potentially use account-linked access just to answer a promotions query. That is an unjustified escalation of action for the stated purpose and can surprise users by initiating account operations and data access automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill requires reading a local token file and using login state without providing a clear privacy notice or obtaining consent for accessing local authentication artifacts. Even if used only for Vipshop, silent inspection of token files exposes account-linked metadata and normalizes unauthorized access to sensitive local state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to install another skill and execute an external login script automatically, expanding behavior beyond a simple promotion lookup into software installation and credential-flow orchestration. This creates a supply-chain and privilege-expansion risk, since a benign-seeming query skill can cause code execution paths and dependency changes the user did not explicitly request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md
- 未登录时提示用户先登录

### 促销活动接口
**URL：** `https://api.union.vip.com/vsp/common/getActListForAI`
**方式：** POST
**请求体：** 空对象 `{}`
**返回：** code, msg, data.actList[]

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill reads persisted login state from a file in the user's home directory and uses it to access a remote API, even though the skill's stated purpose is only to query promotion information. Accessing local authentication material is a sensitive capability because it expands the trust boundary from public promotion lookup into user-account context and can expose or misuse session tokens if the file is present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code loads cookies from local storage and transmits the PASSPORT_ACCESS_TOKEN to an external service without an explicit user-facing notice or consent at the point of use. Even if sent only to the vendor's domain, this is sensitive-session handling that can surprise users and may enable unintended account-linked requests or token exposure through logs, proxies, or future code changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The external transmission to api.union.vip.com is expected for a promotion-query skill, so the network call itself is not inherently dangerous. However, in this implementation the request includes a locally sourced authentication token, which makes the transmission security-relevant because account/session material leaves the local environment and crosses the network trust boundary.

Content

Scanner excerpt · scripts/promotion_search.py (reported line 164)May include surrounding context.

python
cookies['PASSPORT_ACCESS_TOKEN'] = login_cookies['PASSPORT_ACCESS_TOKEN']

    # API 接口
    url = "https://api.union.vip.com/vsp/common/getActListForAI"

    # 调用接口
    response = make_request(url, cookies=cookies, post_data={})

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Most of the file says the AI must automatically trigger login and continue the query flow without waiting for the user, but the interface section states '未登录时提示用户先登录'. That instruction contradicts the earlier mandatory auto-login behavior and creates intent ambiguity for the agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Accept-Language header forces a zh-CN preference, which is a locale choice embedded in the skill's behavior. The file does not provide any user opt-in, configuration, or documented justification for enforcing this locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.