skills/vipshop/vipshop-ai-skills/vipshop-product-detail/Snyk

vipshop-product-detail

Fail

Audited by Snyk on Apr 19, 2026

Risk Level: HIGH

Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 1.00). Insecure: the skill requires reading login tokens (~/.vipshop-user-login/tokens.json) and explicitly shows/uses exchange tokens and PASSPORT_ACCESS_TOKEN (via cookie) — including displaying URLs with exchange tokens directly — which forces the LLM to handle and output secret values verbatim.

Issues (1)

W007

HIGH

Insecure credential handling detected in skill instructions.

Audit Metadata

Risk Level

HIGH

Analyzed

Apr 19, 2026, 09:34 AM

Issues

1