Market Intelligence Claw

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:26 PM UTC
• Version: 1.0.3

Overview

This is a disclosed market-research instruction skill that uses optional third-party data providers with user approval, with no executable installer or hidden persistence.

Install if you are comfortable approving market-research queries that may send public keywords, competitor domains, and geography to the listed providers. Use dedicated low-privilege API credentials, set spending caps, avoid unreleased product names or confidential plans in queries, and confirm the intended marketplace before Amazon-based research.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to use itself for any strategic business decision, even when phrased casually, which is an overly broad activation boundary. This can cause inappropriate invocation on loosely related user queries, increasing unnecessary external research, data exposure risk, and chances of performing actions the user did not clearly request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The phrase covering 'any request to understand the external market landscape' is a broad catch-all that lacks precise limits. In practice, this can overmatch many business conversations and steer the agent into external lookups or profiling workflows without a sufficiently specific request.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill hard-codes `amazon.in` for Rainforest API lookups without asking the user for marketplace or geography, which can silently bias pricing and ranking data toward India. In a market-intelligence skill, this is especially problematic because users may make pricing, competitor, or product decisions from inaccurate region-specific data presented as general market research.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The review collection flow again hard-codes `amazon.in`, causing customer sentiment and review samples to be drawn from the Indian marketplace regardless of the user's target market. Because this skill is intended for strategic business decisions, region-skewed review sentiment can mislead competitive analysis, unmet-needs discovery, and product positioning.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. Seed Keyword Search Volume (Tier 2)
```
POST https://api.dataforseo.com/v3/keywords_data/google_ads/search_volume/live
Body:
[{
  "keywords": ["[keyword 1]", "[keyword 2]", "[keyword 3]"],

• Confidence: 84% confidence
• Finding: https://api.dataforseo.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

### 2. Keyword Expansion (Tier 2)
```
POST https://api.dataforseo.com/v3/dataforseo_labs/google/keyword_suggestions/live
Body:
[{
  "keyword": "[seed term]",

• Confidence: 84% confidence
• Finding: https://api.dataforseo.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

### 3. SERP Landscape — Who Ranks? (Tier 2)
```
POST https://api.dataforseo.com/v3/serp/google/organic/live/advanced
Body:
[{
  "keyword": "[keyword]",

• Confidence: 84% confidence
• Finding: https://api.dataforseo.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

### 4. Competitor Traffic Estimate (Tier 2)
```
POST https://api.dataforseo.com/v3/dataforseo_labs/google/domain_rank_overview/live
Body:
[{
  "target": "competitor.com",

• Confidence: 80% confidence
• Finding: https://api.dataforseo.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

### 5. Competitor Top Keywords (Tier 2)
```
POST https://api.dataforseo.com/v3/dataforseo_labs/google/ranked_keywords/live
Body:
[{
  "target": "competitor.com",

• Confidence: 80% confidence
• Finding: https://api.dataforseo.com/

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.