{"id":"cms5ew7lu7wdiad07mtsgvsxh","slug":"1688-to-ozonskill","publicId":"ce900e95-ece5-4141-a41c-b6d7f4484b24","name":"1688-to-ozon/SKILL","description":"1688 商品自动采集并上传到 OZON 平台","version":"","author":null,"license":"","compatibility":"","status":"completed","overallGrade":"F","scannerVersion":1,"fileCount":0,"hasSkillMd":false,"hasScripts":false,"hasReferences":false,"hasEvals":false,"hasAssets":false,"sourceType":"cli","sourceUrl":"","createdAt":"2026-07-29T01:34:23.859Z","completedAt":"2026-07-29T01:34:21.551Z","visibility":"public","publishedAt":"2026-08-03T21:41:07.006Z","category":"","frameworks":[],"badgeStatus":"flagged","downloadCount":0,"verdictRationale":null,"verdictPolicyVersion":null,"skillId":"cms5ew67m7v8zad07zu95qjqs","findings":[{"id":"cms5ew8jh7xp0ad07nq6ltvfb","source":"vettd","category":"security","label":"High-entropy value — potential hardcoded secret","detail":"Detected in config/config.json:26 — `\"apiKey\": \"sO2cB2TFL6nKA2lxdHyosHXj\",`","severity":"critical","ruleId":"VTD-0003","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"cdc34a29fff05073992792fdacb77138","filepath":""},{"id":"cms5ew8jh7xp1ad07xq0jnsit","source":"vettd","category":"security","label":"High-entropy value — potential hardcoded secret","detail":"Detected in config/config.json:31 — `\"apiKey\": \"sk-sp-2fe17126617744908ad7e6ea2e37b714\",`","severity":"critical","ruleId":"VTD-0003","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"cdc34a29fff05073992792fdacb77138","filepath":""},{"id":"cms5ew8jh7xozad07zjjht08h","source":"vettd","category":"security","label":"High-entropy value — potential hardcoded secret","detail":"Detected in config/config.json:4 — `\"apiKey\": \"c4581d38-1b1e-4884-8f3d-f068b1975ceb\",`","severity":"critical","ruleId":"VTD-0003","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"cdc34a29fff05073992792fdacb77138","filepath":""},{"id":"cms5ew8jh7xp2ad07rpjkk997","source":"vettd","category":"security","label":"High-entropy value — potential hardcoded secret","detail":"Detected in scripts/index.js:79 — `process.env.FEISHU_APP_SECRET = 'G9TdEypJQ9SDOBdExTJVrdn2LtxbdFcV';`","severity":"critical","ruleId":"VTD-0003","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"cdc34a29fff05073992792fdacb77138","filepath":""},{"id":"cms5ew8jh7xotad0733jozw3v","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/index.js:26 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xouad07loayib11","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/logger.js:150 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xovad07nzdz3k5c","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/ocr.js:8 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xowad074p5xm3yv","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/step1-1688.js:24 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xoxad07b71476an","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/step2-img.js:21 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xoyad07py61k73w","source":"vettd","category":"security","label":"Shell execution without sandboxing","detail":"Detected in scripts/lib/step4-upload.js:19 — `const { execSync } = require('child_process');`","severity":"critical","ruleId":"VTD-0018","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"b577cb2b2f20a5fb3b68fd8b6d4d83ce","filepath":""},{"id":"cms5ew8jh7xoqad07sin4s8cx","source":"vettd","category":"scripts","label":"Interactive prompts detected","detail":"scripts/index.js: Agents run in non-interactive shells — replace prompts with CLI flags or stdin","severity":"high","ruleId":"VTD-0115","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"61624aebc3d358d4c95d1f2e18392f90","filepath":""},{"id":"cms5ew8jh7xp4ad07yld09bcs","source":"vettd","category":"security","label":"References external URL — review for indirect prompt injection risk","detail":"External URL(s) detected in SKILL.md — referenced content can change after audit","severity":"medium","ruleId":"VTD-0088","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"885bf1b4de9a77b02bbb1cdf717927d5","filepath":""},{"id":"cms5ew8jh7xp3ad07bl4qac1v","source":"vettd","category":"security","label":"No prompt injection or jailbreak signals detected","detail":"Scanned text content for instruction override, jailbreak framing, credential solicitation, and embedded injection markers","severity":"info","ruleId":"VTD-0092","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"ee5675c6452295fc92108d4c30cfebf6","filepath":""},{"id":"cms5ew8jh7xohad07ffzhnrv7","source":"vettd","category":"security","label":"No repository link","detail":"No repository field found in SKILL.md frontmatter. Skills without a verifiable source repository cannot be externally audited.","severity":"info","ruleId":"VTD-0083","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e09767e7943872a2754f559ba01ef7db","filepath":""},{"id":"cms5ew8jh7xoead07n8d94tkw","source":"vettd","category":"structure","label":"scripts/ directory present","detail":"Bundled executable scripts found","severity":"info","ruleId":"VTD-0096","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"21a167b473d29b0a653734953d43b2fc","filepath":""},{"id":"cms5ew8jh7xodad07aex7mdcu","source":"vettd","category":"structure","label":"SKILL.md present","detail":"Required skill definition file found","severity":"info","ruleId":"VTD-0095","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c4ab14319b89c3d0802fadf0dd105bac","filepath":""},{"id":"cms5ew8jh7xogad074olgu7kz","source":"vettd","category":"structure","label":"Valid name field","detail":"Name \"1688-to-ozon\" follows spec (lowercase, hyphens, ≤64 chars)","severity":"info","ruleId":"VTD-0099","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"5ba54eca0b3e299a99112de98cbcd97f","filepath":""},{"id":"cms5ew8jh7xojad0751pm0eha","source":"vettd","category":"description","label":"Description lacks usage context","detail":"Add context like \"Use this skill when...\" to help agents know when to activate it","severity":"info","ruleId":"VTD-0111","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"e325ab773f2c18f6f9d864add6464110","filepath":""},{"id":"cms5ew8jh7xokad07r7p49y9i","source":"vettd","category":"description","label":"Description too brief","detail":"A few sentences covering scope and trigger conditions improves activation accuracy","severity":"info","ruleId":"VTD-0112","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"592614385df5fc41eb1336fc0e003c01","filepath":""},{"id":"cms5ew8jh7xoiad077fusabsn","source":"vettd","category":"description","label":"Description within character limit","detail":"23/1024 characters used","severity":"info","ruleId":"VTD-0110","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"66553d595a652c45a6f0d4353184b37e","filepath":""},{"id":"cms5ew8jh7xomad07krrrvjnx","source":"vettd","category":"best-practices","label":"Examples included","detail":"Found code blocks, input/output samples, or an examples section — concrete samples help agents pattern-match effectively","severity":"info","ruleId":"VTD-0103","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"c2ceb48c4af3c87dafa32ec2596251b8","filepath":""},{"id":"cms5ew8jh7xonad0731aasetz","source":"vettd","category":"best-practices","label":"No clear workflow structure","detail":"Consider adding numbered steps or a structured procedure for the agent to follow","severity":"info","ruleId":"VTD-0106","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"2368c9a31ac52269c854f105795cf28c","filepath":""},{"id":"cms5ew8jh7xooad079zdl1uv0","source":"vettd","category":"best-practices","label":"Progressive disclosure used","detail":"SKILL.md body references files in references/, scripts/, or assets/ — agents can load additional context on demand instead of consuming everything upfront","severity":"info","ruleId":"VTD-0107","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"6fd5870d64ef20cb2bbaf421f8655a32","filepath":""},{"id":"cms5ew8jh7xolad07p9mthe7g","source":"vettd","category":"best-practices","label":"SKILL.md body length is reasonable","detail":"90 lines (recommended: under 500)","severity":"info","ruleId":"VTD-0101","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"42debaa072535bf5650f90d3168f0b93","filepath":""},{"id":"cms5ew8jh7xopad07exrbbjux","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/index.js: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"bacfb1a11efd590203ff7c5670ad38d8","filepath":""},{"id":"cms5ew8jh7xorad07afjnx3b3","source":"vettd","category":"scripts","label":"CLI help supported","detail":"scripts/ozon/fetch-attribute-values.js: Script documents its interface via --help or argument parsing","severity":"info","ruleId":"VTD-0114","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"bacfb1a11efd590203ff7c5670ad38d8","filepath":""},{"id":"cms5ew8jh7xosad07euiaii33","source":"vettd","category":"scripts","label":"Structured output format","detail":"scripts/ozon/fetch-attribute-values.js: Uses JSON/CSV output which is easily parseable by agents","severity":"info","ruleId":"VTD-0116","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"4ec02baf55eb1cec6e7af5f4773039a2","filepath":""},{"id":"cms5ew8jh7xofad07iysyqvs8","source":"vettd","category":"evals","label":"No evaluation test cases","detail":"Add an evals/ directory with test prompts and expected outputs to measure skill quality","severity":"info","ruleId":"VTD-0118","owaspLlmCategory":null,"intent":null,"chainId":null,"fingerprint":"41d019e0494a4a9763fc23c948d14e09","filepath":""}],"scannerRuns":[{"source":"vettd","status":"success","verdict":null,"grade":null,"findingCount":28,"criticalCount":10,"highCount":1}],"user":{"name":"Justin Pacella","image":"https://avatars.githubusercontent.com/u/97124458?v=4"},"repository":null,"freshness":null,"signalCategories":[{"category":"safety","label":"Safety","form":"graded","verdict":null,"rows":[]},{"category":"reliability","label":"Reliability & Quality","form":"graded","verdict":null,"rows":[]},{"category":"performance","label":"Performance","form":"measured","verdict":null,"rows":[]},{"category":"cost","label":"Cost","form":"measured","verdict":null,"rows":[]},{"category":"compatibility","label":"Compatibility","form":"unjudged","verdict":null,"rows":[]},{"category":"sentiment","label":"Popularity","form":"unjudged","verdict":null,"rows":[]},{"category":"characteristics","label":"Characteristics","form":"unjudged","verdict":null,"rows":[]}],"signalCount":28,"publisherSupplied":["name","description","author","version","license"]}