1688-item-selection
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes product titles and descriptions from an external API, creating a surface for indirect prompt injection. 1. Ingestion points: Product data is retrieved from https://skills-gateway.1688.com in scripts/capabilities/score_and_select/service.py and scripts/capabilities/search_offer_by_keyword/service.py. 2. Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content within the ingested product data. 3. Capability inventory: The skill is limited to data processing and network operations via the requests library; it does not contain sinks such as subprocess.run or eval that would execute ingested data. 4. Sanitization: No explicit validation or filtering is applied to the remote content before it is processed or presented to the user.
- [COMMAND_EXECUTION]: The main entry point cli.py uses importlib.import_module to dynamically load command implementations from the local capabilities directory based on file system discovery.
- [DATA_EXFILTRATION]: The skill includes a telemetry module, _tracker.py, which reports skill usage statistics to the vendor's API gateway.
- [CREDENTIALS_UNSAFE]: Implements a configuration system that reads and writes API credentials to a local configuration file at ~/.openclaw/openclaw.json, following standard agent authentication patterns.
Audit Metadata