Security audit

1688 Shopkeeper

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it handles a commerce access key in ways that can expose it and can publish products to connected stores.

Review before installing. Use this only if you trust the publisher and understand that the AK can authorize 1688 account and shop actions, including product publishing. Prefer a secure OpenClaw secret-entry mechanism instead of pasting the AK in chat or command text, keep OPENCLAW_GATEWAY_URL restricted to a trusted local endpoint, and rotate the AK if it has already been shared in a transcript or logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/configure.py:48
Finding: Configurable Gateway Endpoint Can Receive the AK and Gateway Bearer Token
Content: View full analysis
`. 3. `configure_via_gateway()` constructs a PATCH request to the attacker-controlled origin. 4. The complete AK is included in the JSON request body. 5. If present, the OpenClaw Gateway bearer token is included in the request headers. 6. The attacker records the credentials and can use them independently, ...[truncated 593 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/configure.py:83
Finding: AK Configuration File Is Written Without Explicitly Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/configure.md:19
Finding: Mandatory Workflow Places the Complete AK in Process Arguments and Command Text
Content: View full analysis
3. 检查输出：success=true → 继续；success=false → 展示错误 4.【必须】当前会话后续所有命令前加 ALI_1688_AK= 前缀例如：ALI_1688_AK=xxxyyy python3 cli.py search --query "连衣裙" 原因：configure 写入配置文件后需重启 Gateway 才全局生效，但加环境变量前缀可让当前会话立即可用 5. 继续用户的原始请求（如搜索、铺货等） ``` ``` Related instruction: `SKILL.md`, line 36: ```markdown **刚配置 AK**：当前会话命令前加 `ALI_1688_AK=xxx`，重启 Gateway 后全局生效 ``` ### Technical Analysis The documented workflow instructs the Agent to pass the complete AK as a positional command-line argument and then repeatedly embed it in environment-variable prefixes attached to later commands. Command arguments may be observable through process inspection facilities while the process is running. Depending on the Agent runtime and shell integration, complete command text may also be retained in execution logs, shell history, telemetry, debugging output, or conversation transcripts. Masking the credential only in the command's output does not protect copies already included in the invocation itself. ### Attack Path 1. The user sends the complete AK to the Agent. 2. The Agent follows the mandatory workflow and constructs `cli.py configure `. 3. The runtime records the invocation or exposes it through a process listing. 4. The Agent continues to construct commands prefixed with `ALI_1688_AK=`. 5. A local observer, log reader, telemetry recipient, or transcript reader obtains the complete AK. 6. The exposed AK is reused for authenticated API requests. ### Impact Assessment The disclosure scope depends on which local or remote systems retain command invocations. Any party with access to those records may obtain the complete AK and perf ...[truncated 272 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/_auth.py:195
Finding: Authentication Module Test Entry Point Prints Credential Material
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (29)

Tainted flow: 'gateway_url' from os.environ.get (line 48, credential/environment) → requests.patch (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The script builds the PATCH destination from the untrusted OPENCLAW_GATEWAY_URL environment variable and sends the supplied AK plus optional bearer token to that URL. An attacker who can influence the environment can redirect the request to an attacker-controlled host, causing credential exfiltration or unintended internal network access; the default use of plain HTTP further increases exposure.
Content: Scanner excerpt · scripts/configure.py (reported line 66)May include surrounding context.
python
if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch( f"{gateway_url}/api/config", headers=headers, json=payload,

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly tells users to send their Access Key to the AI in plain chat text ("我的AK是 xxx"). Access keys are authentication secrets, and placing them into a conversational interface risks exposure through logs, prompt history, telemetry, support access, or misuse by the skill itself. In this skill’s context, the key appears to authorize access to 1688 account functions and downstream shop operations, which increases the danger because compromise could enable account access, store linkage, inventory actions, or unauthorized listing/publishing.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This is a direct credential disclosure pattern: the documentation asks the user to paste an Access Key into the AI conversation. That creates a high risk of secret leakage via chat retention, model/provider logging, screenshots, transcripts, or unintended reuse by tools and agents. The skill context makes this more dangerous, not less, because the credential is tied to commerce operations across 1688 and bound downstream stores, potentially enabling unauthorized business actions if the secret is exposed.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Most of the declared functionality matches the code: search_products searches 1688 offers, list_bound_shops retrieves bound shops, and publish_items distributes items to a selected shop/channel. The code uses authenticated requests against 1688 endpoints and supports downstream channel mapping, which is consistent with the description. However, the description also explicitly claims the skill can configure the 1688 AK key, while this code only reads authentication via get_auth_headers and logs that AK is missing from environment configuration; it contains no function to set, save, or manage AK credentials. Because the declared description includes a concrete user-facing capability not present in the supplied code chunk, this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code behavior is narrowly focused on searching 1688 products and persisting/displaying the results. This aligns with declared capability (1) 'search/select products on 1688'. However, the broader description presents the skill as also able to query bound downstream stores, push/list products to multiple platforms, and configure the 1688 AK secret. None of those capabilities are implemented in the supplied code chunk. The optional --channel argument only influences search context/filtering and does not perform cross-platform listing. Therefore, the declared description overstates the implemented functionality of this code chunk, creating a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The AK setup instructions explicitly ask the user to send the access key in chat ('我的AK是 xxx') without warning that it is a secret. In an agent environment, encouraging plaintext credential sharing is dangerous because the secret may be logged, retained in conversation history, exposed to other tools, or mishandled during subsequent actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares access to sensitive capabilities via metadata requirements and documented commands, but it does not define any explicit tool scope such as allowed tools or permissions boundaries. In a skill that can read environment secrets, access local files, and likely perform network-backed commerce actions, missing scope restrictions increases the chance of overbroad execution or unintended tool use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary ecommerce conversation such as '选品', '上架', or '查店铺', which can cause the skill to activate unexpectedly. Because the skill can guide credential setup and initiate listing/publishing workflows, accidental invocation could expose secrets or trigger unintended commerce operations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly tells the user to reveal the full AK in chat and then directs the agent to reuse that secret throughout the session. In this context, the AK is an authentication credential for a commerce platform, so collecting it in conversational text and persisting operational use within the session materially raises the risk of leakage through logs, transcripts, prompts, memory, or downstream tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions place the user's AK directly on the command line and in an environment-variable prefix, which can expose the credential in shell history, process listings, debug logs, and agent execution traces. Reusing the same inline secret across subsequent commands increases the exposure window and the number of places the credential may be recorded.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document assures users that the AK is 'not uploaded to servers' while earlier instructing them to paste the full credential directly into the chat with the agent. That is misleading because the secret is necessarily disclosed to the agent platform and may be logged, retained, or exposed through telemetry, so users are given a false sense of secrecy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The entire FAQ is written only in Chinese and includes prescribed Chinese phrases for interacting with support, such as the escalation wording on L16. There is no indication that the skill is region-specific or that users can choose another language, which may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire FAQ is written in Chinese and does not indicate that language selection is optional or that the content is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire skill content is written only in Chinese and does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is entirely written in Chinese and gives prescriptive output requirements such as fixed Chinese section headings and next-step phrases, but it does not offer any language or locale opt-in. This can violate a language/locale policy when users or agents operate in other languages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module docstring presents the skill name, checks, and usage notes only in Chinese, and the user-facing status messages throughout the file are also Chinese-only. This can violate a language/locale policy when the skill forces a specific language without user opt-in or documented regional scope.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's docstrings, status messages, errors, and usage guidance are all presented in Chinese, with no mechanism for selecting another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code sends the AK over the network through the Gateway API path, with a default URL of http://localhost:18789 and no explicit user-facing notice that the secret is being transmitted. Even if intended for local use, secrets sent over HTTP can be intercepted in misconfigured environments, containerized deployments, remote port forwards, or when the gateway URL is overridden.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This file contains natural-language instructions and output strings that assume Chinese as the only interaction language. Under the policy, forcing a specific language without user opt-in is a violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file presents its description, usage example, and later user-facing messages in Chinese only, with no opt-in or alternative locale. That can violate language/locale policy because it imposes a specific language on users rather than letting them choose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The error and status messages returned to users are written only in Chinese, and the script does not provide a mechanism to choose another language. This creates a natural-language policy concern across runtime interactions, not just in the header comments.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module description and usage-facing strings indicate the skill is designed to respond in Chinese only, and the rest of the file emits Chinese user-facing messages and markdown. The policy requires flagging language or locale constraints when the skill does not provide user opt-in or a documented justification for the restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The guide prescribes exact agent output and user reply phrasing in Chinese, including the required message template for submitting the AK. This appears to force a specific language/locale for interaction rather than offering a choice, which matches the language/locale policy concern described in SQP-3.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing instructional content only in Chinese, and there is no visible opt-in, alternative language option, or justification that the content is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule for natural-language constraints, forcing a specific language without user choice can be a locale policy concern.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency is specified as requests>=2.28.0, which allows any future version to be installed and makes builds non-reproducible. In a commerce automation skill that may handle credentials, store bindings, and product publishing, unpinned dependencies increase supply-chain risk and make it harder to ensure deployment is not using a vulnerable or incompatible release.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Static analysis

No suspicious patterns detected.