ClawHub
Back to skill

Security audit

ShopMind Price Compare

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its shopping price-comparison purpose, but it quietly adds a default affiliate invite code to generated purchase links and has dependency and disclosure gaps users should review.

Review this skill before installing if you care about shopping privacy or affiliate attribution. It sends searches and product IDs to Maishou APIs, and generated purchase links may include the skill's default invite code unless MAISHOU_INVITE_CODE is set. Prefer a version that discloses referral behavior and pins dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/main.py:2
Finding

Unpinned and Unnecessary Runtime Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py:2-5
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

python
# /// script
# requires-python = ">=3.8"
# dependencies = ["aiohttp", "argparse"]
# ///

Technical Analysis

The script uses PEP 723 inline dependency metadata without pinning package versions or integrity hashes. The documented execution method, uv run scripts/main.py, can therefore resolve and install whatever package versions are available from the configured package index at execution time.

The declaration also lists argparse, although argparse is included in the Python standard library for every supported Python version. Resolving a separate package with this name is unnecessary and expands the number of externally controlled components installed before execution.

This does not establish that the current packages are malicious. However, the absence of version and integrity controls means the code reviewed during the audit is not the complete immutable code that may execute. A compromised package release, compromised package index, dependency-confusion condition, or unsafe alternate index configuration could introduce arbitrary code.

Attack Path

  1. A user follows the documented command and runs the script through uv run.
  2. uv reads the inline dependency metadata.
  3. It resolves unpinned versions of aiohttp and the unnecessary argparse package from the configured package source.
  4. If a resolved distribution has been compromised or substituted, attacker-controlled installation or runtime code is placed in the environment.
  5. That code executes during package installation or when the dependency is imported by the script.

Exploitation depends on control or compromise of a package release, package source, network/package configuration, or dependency-resolution environment.

Impact Assessment

Malicious dependency co ...[truncated 446 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove argparse from the dependency list because it is part of the supported Python standard library.
  2. Pin aiohttp to a reviewed, exact version rather than allowing unrestricted resolution.
  3. Maintain a lockfile containing cryptographic hashes for all direct and transitive dependencies.
  4. Install only from an explicitly trusted package index and disable unintended fallback indexes.
  5. Add automated dependency vulnerability and provenance scanning to the release process.
  6. Periodically update the pinned dependency through a reviewed and tested upgrade procedure.

A hardened declaration should contain only the required, reviewed aiohttp version, with the complete environment locked and integrity-verified.

other

Note
Location
scripts/main.py:19
Finding

Purchase Links Silently Include a Fixed Affiliate Invite Code

Content
View full analysis

Vulnerability Details

File Location: scripts/main.py:19 and scripts/main.py:163-175
Vulnerability Type: Undisclosed affiliate attribution and third-party tracking
Risk Level: Low

python
INVITE_CODE = os.getenv("MAISHOU_INVITE_CODE") or "6110440"
python
async def detail(id, source="1", func=None, **kwargs):
    """商品详情 + 购买链接"""
    params = {
        "goodsId": str(id),
        "sourceType": str(source),
        "inviteCode": INVITE_CODE,
        "supplierCode": "",
        "activityId": "",
        "isShare": "1",
        "token": "",
    }

    # 并发请求详情和链接
    detail_resp, link_resp = await asyncio.gather(
        SESSION.post(f"{API_BASE}/api/v3/goods/detail", json={**params, "keyword": "", "usageScene": 5}),
        SESSION.post(f"{SHARE_API}/api/v1/share/getTargetUrl", json={**params, "isDirectDetail": 0}),
    )

Technical Analysis

The product-detail workflow sends an inviteCode to the third-party purchase-link API. Unless the user explicitly defines MAISHOU_INVITE_CODE, the script silently applies the fixed value 6110440.

The skill documentation states that it produces purchase links, but it does not disclose that those links are generated using a default invite or referral identifier. The remote service can consequently associate generated links, and potentially resulting purchase activity, with that identifier.

No evidence establishes that the invite code changes prices, compromises the destination platform, or grants local system access. The confirmed issue is the lack of disclosure and consent for referral attribution.

Attack Path

  1. A user searches for a product and requests its details.
  2. The detail function constructs a request containing the fixed default invite code.
  3. The code sends the product identifier, source platform, and invite code to msapi.maishou88.com.
  4. The service generates and returns a target URL associated ...[truncated 759 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the hardcoded default invite code and omit inviteCode when the user has not explicitly configured one.
  2. Clearly disclose in SKILL.md that generated links may contain affiliate or referral attribution.
  3. Require explicit user opt-in before attaching a referral identifier.
  4. Identify the beneficiary and explain whether attribution can produce commissions or tracking.
  5. Provide a documented non-affiliate mode that generates direct purchase links where supported.
  6. Display an explicit affiliate indicator next to every attributed link.
  7. Minimize data sent to the link service and document the external domains and parameters involved.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes local code via uv run scripts/main.py and explicitly states it makes third-party network requests, but it does not declare any permissions or allowed-tools scope. This creates a transparency and policy-enforcement gap: an agent may execute code with network access without the user or runtime having explicit guardrails on what tools and capabilities are intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description activates on very broad shopping-related intent such as wanting to shop, compare prices, find coupons, or view hot products. Overbroad triggering can cause the skill to run in many ordinary conversations, increasing the chance of unnecessary code execution and third-party data exposure when the user did not explicitly request this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description is Chinese-only and implies Chinese-language behavior without indicating fallback or user-language negotiation. This can lead to unexpected invocation or confusing output for users in other languages, which is mainly a safety/usability issue rather than direct code exploitation, but it still increases the risk of unintended execution in multilingual environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The search function sends user-provided keywords and related query parameters to a third-party external API without any disclosure, consent flow, or privacy notice. In a shopping assistant this is functionally expected, but it still creates a real privacy issue because search terms can reveal sensitive interests, purchasing intent, or personal context to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The detail workflow retrieves external purchase/share links from a third-party API and returns them directly to the user without warning about redirection, tracking, or affiliate behavior. This is risky because users may be sent to external destinations that embed referral data or other tracking parameters, and the skill gives no transparency about that behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The natural-language description at the top of the file is presented only in Chinese and does not offer any language or locale choice. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.