Skill Trust Decision
购物省钱宝
Skill is a legitimate shopping price-comparison tool but exhibits undisclosed outbound network behavior (version check on every API call) and uses unpinned dependencies that create supply chain risk.
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
8 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
What drove the risk score up
Undeclared outbound network calls +20
_check_version() is called on module import and every _wrapped_call_api(), silently fetching clawhub.ai on each user query — not declared in SKILL.md
Unpinned requests dependency +15
requests library used without version constraint; supply chain compromise could affect all users
Opaque third-party API +10
op.squirrel2.cn API processes user queries server-side with no documented data retention policy; SKILL.md says 'data only for this query' but cannot be verified
Most important evidence
Medium Doc Mismatch
Undeclared outbound HTTP call on every query
_check_version() is invoked on module import and again inside _wrapped_call_api() on every user request, performing a GET to https://clawhub.ai/api/v1/skills/pricecompare. This silent outbound call is not documented in SKILL.md, which only mentions the op.squirrel2.cn API.
skill.py:51 Document this behavior in SKILL.md under 'Agent 调用指引' or remove the per-call version check, keeping only the module-import check.
Medium Supply Chain
requests library with unpinned version
The requests library is imported (utils.py, skill.py) without any version pinning. A compromised PyPI release could affect all users of this skill.
utils.py:4 Add a requirements.txt or specify requests>=2.28.0,<3.0.0 to reduce supply chain risk.
Low Data Exfil
Third-party API op.squirrel2.cn has no documented data policy
SKILL.md states '数据仅用于本次查询，发送至 op.squirrel2.cn 处理' but this is a self-asserted claim with no verifiable enforcement. The server is operated by a third party (squirrel2.cn) and could log or retain user queries.
SKILL.md:11 Consider self-hosting the backend or clearly documenting what data is logged and for how long.
Declared capability vs actual capability
Network Pass
Declared READ
→ Inferred READ
skill.py:75-76, utils.py:31-35 — POST requests to op.squirrel2.cn Network Pass
Declared NONE
→ Inferred READ
skill.py:51 — GET requests to clawhub.ai/api/v1/skills/pricecompare on every API call Environment Pass
Declared NONE
→ Inferred READ
config.py:10-11 — reads API_BASE_URL, API_TIMEOUT only; benign config values Filesystem Pass
Declared NONE
→ Inferred NONE
No filesystem access detected Shell Pass
Declared NONE
→ Inferred NONE
No shell execution detected Suspicious artifacts and egress
Medium External URL
http://op.squirrel2.cn/api/v1/ SKILL.md:11
Medium External URL
https://op.squirrel2.cn config.py:11
Medium External URL
https://clawhub.ai/user/zhangjiun1 skill-card.md:9
Medium External URL
https://clawhub.ai/zhangjiun1/skills/pricecompare skill-card.md:35
Medium External URL
https://clawhub.ai/api/v1/skills/ skill.py:35
Medium External URL
https://clawhub.ai/skills/ skill.py:36
Medium External URL
https://item.jd.com/10021724657015.html skill.py:247
Medium External URL
https://e.tb.cn/h.iVW7Wnbs5Woz1ZI skill.py:249
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| requests | * | pip | No | Version not pinned; vulnerable to supply chain attacks |
File composition
7 files · 1153 lines
Python 4 files · 974 linesMarkdown 2 files · 174 linesJSON 1 files · 5 lines
Files of concern · 5
utils.py requests library with unpinned version
skill.py Undeclared outbound HTTP call on every query · https://clawhub.ai/api/v1/skills/ · https://clawhub.ai/skills/ · https://item.jd.com/10021724657015.html · https://e.tb.cn/h.iVW7Wnbs5Woz1ZI
SKILL.md Third-party API op.squirrel2.cn has no documented data policy · http://op.squirrel2.cn/api/v1/
config.py https://op.squirrel2.cn
skill-card.md https://clawhub.ai/user/zhangjiun1 · https://clawhub.ai/zhangjiun1/skills/pricecompare
Other files · formatters.py · _meta.json
Security positives
No code obfuscation (base64, eval, or bytecode loading)
No credential harvesting or environment variable iteration for secrets
No file system or shell access
No access to sensitive paths (~/.ssh, ~/.aws, .env)
No reverse shell, C2, or data exfiltration patterns
Version checking can be disabled via PRICECOMPARE_NO_VERSION_CHECK environment variable
API errors are handled gracefully without exposing internals