ClawHub
Back to skill

Security audit

Pinduoduo Automation

Security checks for vulnerabilities and agentic risk

Overview

This skill is broadly aimed at Pinduoduo store automation, but it asks for sensitive store credentials and advertises live business-changing actions without enough safeguards.

Review this skill before installing in a production store. Do not place real Pinduoduo secrets in config.yaml unless you are comfortable with local plaintext storage, and avoid granting broad API permissions until the skill documents confirmations, dry-runs, rollback steps, and exact data handling for store automation and competitor monitoring.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
config.yaml:7
Finding

Plaintext API Credential Storage Contradicts the Encryption Claim

Content
View full analysis

Vulnerability Details

File Location: config.yaml:7-12; related instructions in SKILL.md:50-53, 88-92
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

yaml
api:
  # Pinduoduo Open Platform API configuration
  # Obtain credentials from: https://open.pinduoduo.com/
  app_key: ""        # To be filled in
  app_secret: ""     # To be filled in
  access_token: ""   # To be filled in

The corresponding documentation directs users to edit this configuration file and claims that API keys are stored in encrypted form:

markdown
# Edit the configuration file
nano ~/.openclaw/workspace/skills/pinduoduo-automation/config.yaml

# Fill in the shop ID, API key, etc.
markdown
## Security Notes
- API keys stored encrypted
- Operation logging
- Sensitive-data masking
- Principle of least privilege

Technical Analysis

The configuration schema provides ordinary YAML string fields for an application key, application secret, and access token. No encryption, secret-manager integration, runtime environment-variable loading, permission validation, or masking implementation exists in the audited files.

Users following the documented setup process would therefore place credentials directly into a plaintext file. The documentation's encryption claim may give users a false assurance that these values receive cryptographic protection.

Plaintext credentials can be disclosed through source-control commits, backups, support bundles, package redistribution, permissive filesystem permissions, or access by another process running under the same account.

Attack Path

  1. A user follows SKILL.md and enters valid Pinduoduo credentials into config.yaml.
  2. The values remain as plaintext because the project implements no encryption or protected credential storage.
  3. The configuration is copied into source control, a backup, an archive, or ...[truncated 807 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove secret values from distributable YAML configuration files.
  2. Load credentials at runtime from a supported operating-system secret store, dedicated secret manager, or protected environment injection mechanism.
  3. If a local credential file is unavoidable, keep it outside the project/package directory, enforce owner-only permissions such as mode 0600, and reject files with unsafe ownership or permissions.
  4. Add all local secret-bearing files to source-control and packaging exclusion rules.
  5. Provide a committed example configuration containing only placeholders and non-sensitive settings.
  6. Remove the encrypted-storage claim until encryption is actually implemented and verified.
  7. Avoid logging or displaying secrets, and redact credential fields from diagnostics and error output.
  8. Document credential rotation and revocation procedures for users who may already have stored or committed secrets in this file.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/daily-report.sh:5
Finding

Predictable Report Output Permits Symbolic-Link File Clobbering

Content
View full analysis

Vulnerability Details

File Location: scripts/daily-report.sh:5-11
Vulnerability Type: Unsafe predictable output file and symbolic-link following
Risk Level: Low

Vulnerable Code

bash
REPORT_DATE=$(date +%Y-%m-%d)
REPORT_FILE="$HOME/.openclaw/workspace/skills/pinduoduo-automation/reports/daily-${REPORT_DATE}.md"

echo "📊 生成拼多多每日销售报告 - ${REPORT_DATE}"
echo "=========================================="

# TODO: 接入真实 API 数据
cat > "$REPORT_FILE" << REPORT

Technical Analysis

The script derives the destination from a predictable date-based filename and opens it with shell truncation redirection. It does not verify that the report directory is securely owned, that the destination is a regular file, or that the destination is not a symbolic link.

Shell redirection follows symbolic links. Consequently, if an attacker can create or replace entries in the report directory, the attacker can place a symbolic link at the expected report path and direct it to another file writable by the user running the script. Running the report then truncates and replaces the target with generated Markdown.

The script also lacks strict error handling and does not create or validate the parent directory. Those reliability issues can conceal failed writes, although they do not independently establish a privilege escalation.

Attack Path

  1. An attacker obtains write access to the configured reports directory.
  2. Before the daily report runs, the attacker calculates the predictable path daily-YYYY-MM-DD.md.
  3. The attacker creates that path as a symbolic link to another file writable by the victim account.
  4. The victim invokes scripts/daily-report.sh.
  5. The cat > "$REPORT_FILE" redirection follows the symbolic link, truncating and replacing the linked target with the generated report.

Impact Assessment

Exploitation allows destruction or replacement of files writable by the account invoking the ...[truncated 431 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create and validate the report directory with restrictive permissions and trusted ownership:
    bash
    REPORT_DIR="$HOME/.openclaw/workspace/skills/pinduoduo-automation/reports"
mkdir -p -- "$REPORT_DIR"
chmod 700 -- "$REPORT_DIR"
  2. Reject an existing symbolic-link destination before writing:
    bash
    if [[ -L "$REPORT_FILE" ]]; then
  echo "Refusing to write through a symbolic link" >&amp;2
  exit 1
fi
  3. Generate output in a securely created temporary file inside the trusted report directory and atomically rename it into place:
    bash
    tmp_file=$(mktemp -- "$REPORT_DIR/.daily-${REPORT_DATE}.XXXXXX")
trap 'rm -f -- "$tmp_file"' EXIT
# Write the report to "$tmp_file".
mv -T -- "$tmp_file" "$REPORT_FILE"
trap - EXIT
  4. Where supported, use file-opening mechanisms that enforce no-follow and exclusive-creation semantics rather than relying solely on a separate symbolic-link check.
  5. Add set -euo pipefail and explicit error handling so directory or output failures terminate the script rather than producing misleading success output.
  6. Do not run the reporting script with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises automated product listing, inventory sync, order processing, and logistics actions without clearly warning that these features can modify live store data and trigger external side effects. In an automation context, users may invoke actions assuming they are informational, which increases the risk of unintended operational changes, data corruption, or business disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script's user-facing title and output strings are all in Chinese, and there is no indication that the skill is region-specific or that users can opt into a preferred language. That can violate language/locale policy when a skill implicitly forces one language for all users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is very broad, advertising end-to-end merchant automation including product management, order handling, analytics, competitor monitoring, and smart pricing, but it provides no activation boundaries, guardrails, or explicit prohibited actions. In an automation skill, this can cause overbroad invocation and unsafe delegation of sensitive business operations, increasing the chance that downstream instructions perform unintended account, pricing, or monitoring actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language instructions and labels are fully Chinese, which effectively forces a specific language for use of the skill. The file does not mention that the skill is China-specific or provide an opt-in or alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The competitor monitoring and analytics sections describe collecting pricing, sales, review, traffic, and ROI data without warning users about processing shop data and potentially transmitting or scraping third-party information. This lack of transparency can lead to privacy, compliance, or terms-of-service issues if users enable the features without understanding what data is accessed and where it is sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This manifest/config file contains natural-language comments and labels entirely in Chinese, such as the title and API setup instructions. For a general-purpose skill, forcing a specific language in user-facing configuration without opt-in or documented regional justification can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This shell script uses Chinese in its title, generated report content, and console messages throughout the file. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The user-facing description is presented only in Chinese, which may impose a language/locale choice without offering alternatives or documenting that the skill is intended only for a Chinese-speaking audience. This can conflict with language-choice policy unless the locale restriction is explicit and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.