SS需求→Teambition任务

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.4

Overview

The skill has a coherent automation purpose, but it ships a likely real SaleSmartly API key and gives risky handling instructions for customer conversations and Teambition tokens.

Review before installing. Do not use this package as-is with production accounts: revoke and remove the bundled SaleSmartly key, configure SaleSmartly and Teambition credentials through a protected secret mechanism, pin and review the MCP package, restrict who can read the generated data directory and Teambition project, and add a human approval or redaction step before customer conversations are copied into tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/config.json:2
• Finding: Hardcoded SaleSmartly API Credential Distributed with the Skill## Vulnerability Details **File Location**: `scripts/config.json:2-4` **Vulnerability Type**: Hardcoded API credential **Risk Level**: High ```json "ss": { "apiKey": "19vLWeRmwTBscpES", "projectId": "b87x3n", ``` ### Technical Analysis The project contains a non-placeholder SaleSmartly API key in a committed configuration file. This key is subsequently used by `scripts/collect.py` as an HTTP bearer credential: ```python req.add_header("Authorization", f"Bearer {self.api_key}") ``` Unlike the placeholder in `config.example.json`, the value in `config.json` appears to be an actual credential. Any person or automated system with access to the project package can extract and attempt to use it. The exposure remains relevant even if the key is later deleted from the latest revision because it may persist in package archives, source-control history, caches, and backups. ### Attack Path 1. An attacker downloads or otherwise obtains the skill package. 2. The attacker opens `scripts/config.json` and extracts the SaleSmartly API key and project identifier. 3. The attacker sends requests to the SaleSmartly API with the key in the `Authorization: Bearer` header. 4. Subject to the key's server-side permissions, the attacker queries session, message, or contact endpoints used by the collector. 5. The attacker retrieves customer conversations and metadata or consumes the credential's API quota. ### Impact Assessment Successful exploitation could provide unauthorized access to the SaleSmartly resources authorized for this API key. The exposed scope may include customer names, contact identifiers, project identifiers, session metadata, and private conversation content. It could also permit API abuse and quota consumption. The exact privileges are limited by the permissions SaleSmartly assigned to the credential.
• Remediation: ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately. 2. Remove `scripts/config.json` from all distributed packages and source-control history. 3. Add `config.json` and other secret-bearing files to `.gitignore` and packaging exclusion rules. 4. Load the key from a protected environment variable or dedicated secret manager. 5. Grant the replacement key only the minimum read permissions required by the collector. 6. Add automated secret scanning to CI and release workflows. 7. Review SaleSmartly access logs for use of the exposed key and investigate unexpected requests.

T08 · Insecure Dependencies

Warning

• Location: references/tb_mcp_setup.md:13
• Finding: Unpinned Global Installation of a Third-Party MCP Package## Vulnerability Details **File Location**: `references/tb_mcp_setup.md:13-16` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ```markdown ## 2. Install CLI Tool ```bash npm install -g teambition-openapi-mcp ``` ``` ### Technical Analysis The installation instructions retrieve and globally install the latest available release of `teambition-openapi-mcp` without an exact version, lockfile, integrity hash, or documented publisher verification. Consequently, the package installed by a user can differ from the version considered during the skill audit. npm packages can execute lifecycle scripts during installation. A compromised publisher account, malicious future release, or supply-chain takeover could therefore execute code with the privileges of the user performing the global installation. At runtime, the package also receives access to the Teambition user token configured for the MCP service. ### Attack Path 1. The upstream package, publisher account, or package distribution channel is compromised, or an unsafe future release is published. 2. A user follows the skill instructions and runs the unpinned global installation command. 3. npm retrieves the current package release rather than a previously reviewed version. 4. Malicious installation lifecycle code or runtime code executes with the installing user's privileges. 5. The compromised package accesses local files, environment data, OpenClaw configuration, or the Teambition token supplied when the MCP server starts. 6. The stolen data may be transmitted externally, or Teambition operations may be performed as the affected user. ### Impact Assessment Exploitation could lead to arbitrary code execution under the installing user's account. The reachable scope may include user-readable files, OpenClaw configuration, Teambition credentials, and Teambition resources available to the victim. If installation is performed with elevated pr ...[truncated 73 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, such as `package-name@x.y.z`. 2. Use a project-local dependency with a committed lockfile instead of a global installation. 3. Verify package provenance, publisher identity, repository ownership, and release signatures where available. 4. Enforce npm integrity metadata and review transitive dependencies. 5. Disable lifecycle scripts during installation when they are not required. 6. Run the MCP server in a sandbox with restricted filesystem and network access. 7. Establish a controlled upgrade process in which each new package version is reviewed before adoption.

T09 · Insecure Skill Coding Practices

Error

• Location: references/tb_mcp_setup.md:27
• Finding: Teambition User Token Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `references/tb_mcp_setup.md:27-30` **Vulnerability Type**: Credential exposure through process arguments **Risk Level**: High ```json "teambition-mcp": { "command": "teambition-openapi-mcp", "args": ["user-mcp", "-u", "YOUR_USER_TOKEN"] } ``` The displayed placeholder above represents the user token that the instructions require users to place directly in the `args` array. ### Technical Analysis The setup procedure passes the Teambition user token through the process command line. Depending on operating-system and runtime configuration, process arguments may be exposed through process-listing tools, `/proc` interfaces, diagnostic reports, monitoring agents, crash reports, or service-management logs. The token is also stored directly in the OpenClaw configuration. If that file has permissive permissions, is included in backups, or is copied into support diagnostics, the credential can be disclosed independently of process inspection. ### Attack Path 1. A user configures the MCP service with a valid Teambition token in the command arguments. 2. OpenClaw starts `teambition-openapi-mcp` with the token present in its process argument vector. 3. Another local user, monitoring tool, diagnostic collector, or compromised process reads the process arguments or configuration file. 4. The observer extracts the token. 5. The token is used with the Teambition API or MCP tooling to act as the affected user. ### Impact Assessment An attacker obtaining the token could access Teambition with the permissions associated with the victim's account. Depending on those permissions, this may include reading project information and tasks, creating tasks, modifying task notes and custom fields, or changing task state. The exposure does not inherently grant operating-system administrator privileges, but it can compromise all Teambition resources authorized for that token.
• Remediation: ## Remediation Suggestions 1. Do not place bearer tokens in command-line arguments. 2. Use OpenClaw's protected secret facility or another operating-system credential store. 3. If the MCP program supports it, pass the token through a restricted file descriptor or protected token file. 4. If an environment variable is the only supported alternative, ensure it is not included in diagnostics and restrict access to the process environment. 5. Set owner-only permissions on the OpenClaw configuration and any token file. 6. Redact credentials from process logs, crash reports, support bundles, and monitoring telemetry. 7. Use a narrowly scoped token and implement regular token rotation.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collect.py:270
• Finding: Sensitive Customer Conversations Written to Plaintext Files with Default Permissions## Vulnerability Details **File Location**: `scripts/collect.py:270-280` **Vulnerability Type**: Insecure storage of sensitive data **Risk Level**: Medium ```python output = { "meta": { "collected_at": datetime.now().isoformat(), "time_window": {"start": start_ts, "end": end_ts}, "total_sessions": len(results), }, "sessions": results, } out_path.write_text(json.dumps(output, ensure_ascii=False, indent=2)) print(f"\n💾 已写入: {out_path}") print(f" {len(results)} 个会话, 共 {sum(r['msg_count'] for r in results)} 条消息") ``` ### Technical Analysis The collector serializes complete session results to an unencrypted JSON file. The `results` collection includes customer names, chat-user identifiers, SaleSmartly project identifiers, session metadata, sender identifiers, message identifiers, timestamps, and message content. `Path.write_text()` creates or replaces the output using permissions derived from the process umask. The script does not explicitly enforce owner-only permissions on either the output directory or generated files. On systems with a permissive umask or shared workspace, other local users and processes may be able to read the records. Although the script deletes matching files after seven days, retention cleanup does not protect data during that interval. It also does not remove copies captured by backups, synchronization systems, snapshots, or indexing services. ### Attack Path 1. An authorized user or scheduled job runs `scripts/collect.py`. 2. The collector downloads customer contacts and up to 500 messages per matching session. 3. The script writes this information to `scripts/data/ss_sessions_YYYY-MM-DD.json`. 4. A local user, compromised process, shared-workspace participant, backup service, or synchronization system reads or copies the plaintext file. 5. Private customer communications and associated identifiers are disclosed outside their intended processin ...[truncated 468 chars]
• Remediation: ## Remediation Suggestions 1. Create the output directory with owner-only permissions, such as mode `0700`. 2. Create generated files with mode `0600` and verify permissions after writing. 3. Use atomic file creation that does not temporarily expose content with broader permissions. 4. Encrypt collected conversation data at rest using a key stored separately from the output directory. 5. Minimize stored data by excluding unnecessary identifiers and redacting sensitive message content. 6. Make retention configurable and default to the shortest period required for processing. 7. Exclude the data directory from source control, cloud synchronization, general backups, and support bundles. 8. Delete files immediately after successful analysis and task creation when continued retention is unnecessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明描述的是一个端到端自动化流程：采集 SaleSmartly 会话 → AI 分析提取需求 → 创建 Teambition 任务。实际代码只实现了第一步的数据采集：读取配置，调用 SaleSmartly 的会话、消息、联系人接口，按标签过滤，保存为 data/ss_sessions_YYYY-MM-DD.json，并维护 state.json 与过期文件清理。代码中没有任何 AI/LLM 调用、需求提取逻辑、Teambition API 集成或任务创建操作。因此声明明显高于实际实现，属于能力描述与代码行为不一致。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read and write local files and invoke a networked script/API flow, but it does not declare any explicit tool scope or allowed-tools boundaries. In an agent environment, missing capability scoping increases the chance of overbroad tool use, unintended file access, or network actions beyond what the user expects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill processes customer support conversations and directs that data to AI analysis and Teambition task creation, but it does not prominently warn users that potentially sensitive customer content may be transmitted to external systems. This creates a meaningful privacy and data-governance risk, especially if chats contain personal data, account details, or confidential business information.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file is natural-language guidance for operating the skill, and its title and subsequent instructions are exclusively in Chinese. Because the file does not offer the user an opt-in language choice or state that the skill is intentionally limited to a Chinese-speaking context, it may violate language/locale policy requirements.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide explicitly instructs copying customer conversation content, customer identifiers, session IDs, project IDs, and the real names of support agents into Teambition tasks. This creates a clear privacy and data-governance risk because potentially sensitive personal or business information is propagated into another system without any minimization, consent, retention, or access-control guidance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs the user to embed a Teambition User Token directly in a local JSON config file, which increases the chance of accidental disclosure through file sharing, backups, screenshots, shell history, or source control. In this skill context, the token grants API access for task/project operations, so exposure could let an attacker query projects or create/modify tasks under the user's account.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The script reads configuration containing API credentials and uses them in authenticated HTTP requests to retrieve session messages and contact data. While the network activity is central to the script's purpose, there is no explicit disclosure in the code comments or runtime output that credentials will be used to access remote customer data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script exports full customer conversations, customer identifiers, and inferred project metadata into JSON files on local disk without any explicit sensitivity warning, consent checkpoint, masking, or storage protection. In this skill context, the data is inherently likely to contain personal data, support history, and potentially confidential business information, so silent bulk persistence increases the risk of privacy leakage, over-retention, and accidental disclosure from the local workspace.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: This JSON manifest describes analysis behavior and a scheduled execution window, but it does not clearly specify the activation scope, trigger phrases, or exclusion conditions for when the skill should process conversations and create TB tasks. In a manifest file, missing trigger constraints can cause unintended or overly broad invocation behavior.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The file mandates Chinese-language operational instructions and output formats without indicating that the user can choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: All user-facing instructions and the example invocation are presented only in Chinese, including the explicit phrase the user should say to the AI. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The configuration hard-codes the locale-specific setting "Asia/Shanghai" and pairs it with China-specific holiday handling, which imposes a specific regional default in natural-language guidance. The file does not indicate that users may choose a different timezone or that the China-specific behavior is only an example or region-limited default.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The schedule configuration fixes execution to the Asia/Shanghai timezone, which is a locale-specific setting. Because the file does not document user choice, opt-in, or a clear region-specific justification, this can be a natural-language policy concern under locale constraints.

Static analysis

No suspicious patterns detected.