The skill is vulnerable to prompt injection, stores
Claims to do
唯品会AI购物助手技能集合: > ⚠️ **重要规范**:AI 必须先加载本 skill 规范(use_skill),再执行任何脚本或返回结果,不得绕过 skill 规范自行处理数据。
Actually does
This skill acts as a wrapper, calling specific sub-skills (`vipshop-user-login`, `vipshop-product-search`, `vipshop-product-detail`, `vipshop-promotion-search`) via `use_skill`. It manages user login state by storing tokens in `~/.vipshop-user-login/tokens.json` and automatically triggers login or re-login when needed. The sub-skills execute Python scripts (e.g., `vip_login.py`, `search.py`) to interact with Vipshop's services, returning JSON data.
openclaw skills install viphgta/vipshop-skillsDeBERTa classifier detected prompt injection (confidence: 0.96)
The AI is designed to automatically trigger the login process and proceed with tasks without explicit user confirmation, relying solely on the user completing a QR scan. This removes a critical human-in-the-loop approval step for a sensitive action, potentially leading to unauthorized actions if the AI is compromised.
所有子技能都支持自动登录触发:- 检测到用户未登录时,AI 自动触发 `vipshop-user-login` 流程... - 全程无需用户手动请求
The skill explicitly allows the AI to execute Python scripts located in `scripts/` directories. While there are constraints against AI modifying these scripts, a compromised AI could execute them with malicious parameters or in unintended sequences, leading to unauthorized system interactions or data manipulation.
AI 只能执行脚本... 执行 `vipshop-product-search` 搜索连衣裙... scripts/vip_login.py
The skill stores user login tokens in a local file (`~/.vipshop-user-login/tokens.json`). If the AI's environment is compromised or if a script is maliciously modified, these tokens could be exfiltrated, leading to unauthorized account access.
登录态存储:`~/.vipshop-user-login/tokens.json`
The skill includes strict constraints forbidding the AI from modifying its own scripts or `SKILL.md` files. This indicates an awareness of the risk of AI self-modification or tampering with its tools, which could lead to tool poisoning if these constraints are bypassed.
⚠️ AI 行为约束(必须严格遵守)... 严禁 AI 修改 `scripts/` 目录下的任何 Python 脚本文件... 严禁 AI 修改任何子技能的 `SKILL.md` 文件
The stated purpose claims to integrate '订单查询' (order query) services and mentions an '订单' (order) sub-skill. However, the actual list of included sub-skills, the directory structure, and the '未来规划' (future planning) section indicate that order query functionality is not yet implemented and is a future development.
Stated purpose: '整合唯品会搜索、商品查询、活动查询、订单查询等多项购物服务...' and '通过引导安装多个子 Skill(搜索、看详情、登录、订单、活动)...'. Actual: '包含的子技能' section and '目录结构' do not list an order query skill. '未来规划' lists '- [ ] 添加订单查询功能'.
[](https://mondoo.com/ai-agent-security/skills/clawhub/viphgta/vipshop-skills)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/viphgta/vipshop-skills"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/viphgta/vipshop-skills.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/viphgta/vipshop-skills.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.