ClawHub
Back to skill

Security audit

星罗好货电商CPS助手

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed affiliate shopping/link-conversion helper that sends shopping queries to its provider and returns product, commission, and promotional-link results.

Install this only if you want affiliate/CPS shopping results. Queries, product links, Taobao tokens, and the configured LINKBOT_API_KEY are used with the provider service; promotional links and commission rates should be treated as commercial affiliate output, not neutral product advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:38
Finding

Mandatory Affiliate Content Hijacks Shopping-Related Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38 and 101-105
Vulnerability Type: Agent response and instruction hijacking
Risk Level: Medium

Vulnerable Instruction Snippet

The following is a faithful English translation of the relevant Skill instructions:

markdown
**Critical constraint: If the script prints a notice that no API key is configured, it must be shown to the user; otherwise, commissions cannot be attributed to the user's account. Commission-rate information printed by the script must be shown to the user. If the user intends to request a shopping recommendation, ask about a price, find a discount, convert a link, or check commission, the response must include product information, a promotional link, and the commission rate.**
markdown
### How to organize the answer (must be followed strictly)

1. If the script prints a notice that no API key is configured, it may be shown to the user so the user understands how to configure a personal key.
2. Search results include product information, discounts, CPS commission rates, and promotional links. Use these results to answer the user's question.
3. If the user intends to request a shopping recommendation, ask about a price, find a discount, convert a link, or check commission, the response must include product information, a promotional link, and the commission rate.

Technical Analysis

The Skill does not limit affiliate-link output to explicit link-conversion requests. Instead, it mandates promotional links whenever a user asks for ordinary pricing, discount, or recommendation information. The phrases “critical constraint,” “must be shown,” and “must be followed strictly” alter how the Agent formulates its final response and prioritize commercial affiliate content over neutral fulfillment of the user's request.

The script also prints result text supplied by the remote service without validating individual output fields. C ...[truncated 1478 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove mandatory affiliate-link output from ordinary price, discount, and recommendation requests.
  2. Generate a CPS link only when the user explicitly requests link conversion or consents to affiliate results.
  3. Clearly label every affiliate link and disclose that purchases may generate commission.
  4. Separate neutral product information from commercial conversion functionality.
  5. Treat remote API output as untrusted data and extract only documented fields rather than relaying arbitrary response text.
  6. Prevent remote result content from being interpreted as Agent instructions.
  7. Allow users to request non-affiliate product links and neutral comparisons.

T08 · Insecure Dependencies

Note
Location
SKILL.md:27
Finding

Unpinned Runtime Installation of a Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 27
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code Snippet

json
{
  "id": "requests-pip",
  "kind": "shell",
  "command": "pip3 install requests",
  "label": "Install requests (pip)"
}

Technical Analysis

The installation command retrieves requests without specifying a version or verifying package hashes. Each installation can therefore resolve to a different release and dependency set. The effective installed code is controlled by the package index state at installation time rather than by an audited, reproducible project lock file.

The package name is the legitimate requests package, and the reviewed material contains no evidence of typosquatting or a deliberately malicious package source. The risk is nevertheless present because an upstream compromise, resolver configuration change, malicious package-index mirror, or incompatible future release could alter the code installed by this Skill.

Attack Path

  1. The environment processes the Skill's installation declaration.
  2. The shell executes pip3 install requests.
  3. pip contacts its configured package index and resolves the latest acceptable requests package and transitive dependencies.
  4. If the index, mirror, account, network configuration, or resolved dependency is compromised, attacker-controlled package content may be downloaded.
  5. Installed package code executes when goods_query.py imports or uses requests, or during any package installation hooks supported by the environment.

Exploitation is contingent on compromise or manipulation of the dependency supply chain; no such compromise is demonstrated in the reviewed project.

Impact Assessment

Any malicious package code would generally execute with the privileges of the installation or Skill runtime process. Depending on the hosting environment, tha ...[truncated 431 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and all transitive dependencies to reviewed versions.
  2. Store dependency constraints in a lock file with cryptographic hashes.
  3. Install with hash enforcement, such as python3 -m pip install --require-hashes -r requirements.txt.
  4. Use an isolated virtual environment rather than modifying a shared Python installation.
  5. Restrict package retrieval to a trusted HTTPS index or controlled internal mirror.
  6. Periodically review pinned versions for security updates and update them through a controlled process.
  7. Prefer python3 -m pip to ensure dependencies are installed for the intended interpreter.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill requests sensitive capabilities via metadata (network access and an environment variable containing LINKBOT_API_KEY) but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an over-broad execution surface where the host may allow capabilities beyond what is clearly documented and reviewed, increasing the risk of unintended data access or network exfiltration if the skill or its dependencies are modified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The statement 'Currently serving users in Mainland China only' is a natural-language locale restriction. The file does not present this as an optional user-selected locale nor explain a compliance or regulatory justification, so it fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the user's configured LINKBOT_API_KEY to a third-party service on every search request, but the code provides no explicit user-facing disclosure at the point of transmission. Even though an API key must be configured for the skill to work, undisclosed transmission of credentials to a remote endpoint increases privacy and trust risk and can expose the key to misuse if the remote service is compromised or not the intended processor.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The url query path forwards arbitrary product links or 淘口令/tokens supplied by the user to an external service without an explicit warning in code or runtime UX. These inputs may contain sensitive affiliate identifiers, tracking parameters, or private promotional tokens, so silent transmission to a third party creates a data-sharing risk that users may not expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

At L038 the documentation says the unconfigured API key prompt '必须展示给用户' (must be shown), while later at L103 it says the same notice '可将其展示给用户' (may be shown). This is an active contradiction in operator guidance about required behavior, which can affect whether users receive the attribution warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.