Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明的核心功能是对亚马逊 ASIN 进行优势分析，但实际代码并未执行分析请求，也未获取详情、销量趋势、销量预测等分析结果。相反，它访问的是
/asin_advantage/search/logs日志接口，用于读取搜索日志记录。这属于与声明主用途明显不同的行为，且包含未声明的日志访问能力，因此存在描述与行为不一致。- Content
Security audit
clawec-amazon-asin-advantage
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed ClawEC API helper for Amazon ASIN analysis, with expected external API use and no evidence of hidden persistence, credential theft, or destructive behavior.
Install only if you are comfortable sending ASIN research queries and related parameters to ClawEC using your ClawEC API key. Use a dedicated or revocable API key, store it in CLAWEC_API_KEY or a secret manager, and avoid running history/detail helpers unless you intend the agent to access your ClawEC ASIN search logs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
sh script_dir = sys.argv[3] args = sys.argv[4:] env = os.environ.copy() search_sh = os.path.join(script_dir, "search.sh") logs_sh = os.path.join(script_dir, "logs.sh") detail_sh = os.path.join(script_dir, "log_detail.sh")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents use of environment variables and shell commands to call an external API, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and transparency gap: an agent may invoke shell or read secrets without the skill explicitly constraining or disclosing those capabilities.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs sending ASIN query parameters and a bearer token to a third-party service but does not warn users that their inputs will be transmitted externally or explain privacy implications. This can lead to unintended disclosure of business-sensitive product research data and increases the risk of secret mishandling around the API key.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill explicitly performs external transmission of user-supplied ASIN data and an authorization bearer token to a third-party endpoint. In this skill context, external transmission is expected, but it remains security-relevant because it can expose sensitive commercial research inputs and creates credential leakage risk if requests, shells, or logs are mishandled.
- Content
| JP | 日本 |
bash curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/asin_advantage/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $CLAWEC_API_KEY" \ -d '{"marketplace":"US","asin":"B0XXXXXX","month":"202505","asinDetail":true,"salesTrend":true,"aiInterpret":true}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This shell script reads a credential from the CLAWEC_API_KEY environment variable and immediately makes an outbound HTTP request with the provided log ID. There is no confirmation prompt, visible user-facing notice, or inline documentation warning that sensitive credentials and request parameters will be sent to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script makes an outbound request to a third-party API using a bearer credential without any built-in user disclosure, confirmation, or visible indication that data and credentials are being used externally. In an agent-skill context, this can lead to silent transmission of user-supplied parameters to an external service, reducing transparency and potentially surprising users or operators.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends user-supplied ASIN, marketplace, month, and option flags to a third-party endpoint while authenticating with a bearer token, but it does not provide any user-facing disclosure or confirmation before transmission. This can cause users or orchestrating agents to unknowingly exfiltrate business-sensitive product research queries to an external service.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The script performs an external POST request to a third-party API and includes both user-derived data and an Authorization bearer token. In the context of an agent skill, external transmission is security-relevant because it can leak user queries or commercially sensitive ASIN analysis requests outside the local trust boundary without visible consent controls.
- Content
sh now=datetime.now(); mo=now.month-1 or 12; yr=now.year if now.month>1 else now.year-1; body["month"]=f"{yr}{mo:02d}" print(json.dumps(body, ensure_ascii=False)) ' "$MARKETPLACE" "$ASIN" "$MONTH" "$DETAIL" "$TREND" "$PRED" "$AI") curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/asin_advantage/search" -H "Content-Type: application/json" -H "Authorization: Bearer $API_KEY" -d "$PAYLOAD"
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
SQP-3 covers natural-language policy issues such as forcing a specific language without user opt-in. The description here is entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's user-facing messages are hardcoded in Chinese ('用法' and '请设置环境变量') with no indication that the skill is intended only for Chinese-speaking users or a specific locale. This creates a language policy concern because the skill enforces a specific language without user opt-in or justification.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes a skill for analyzing Amazon ASIN advantage via the ClawEC API, but does not mention handling secrets or credential sourcing. While network access is expected for this purpose, explicit access to host environment variables is an additional capability outside the user-facing purpose described.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The environment-variable error message is hardcoded in Chinese ("请设置环境变量 CLAWEC_API_KEY"), which imposes a specific language on users regardless of their locale or preferences. The policy requires avoiding fixed language constraints unless the skill offers language choice or clearly documents a justified locale limitation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The usage and error messages are hardcoded in Chinese, such as the help text at L04 and the missing-variable/error text at L19-L20. This imposes a specific language on all users without opt-in or documented locale justification, which is a natural-language policy violation under the stated rules.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes an ASIN advantage analysis skill with optional AI interpretation, but the code additionally depends on reading a secret from the process environment via CLAWEC_API_KEY. While likely necessary for the external API call, credential access is a distinct capability not mentioned in the stated purpose and can be context-inappropriate if permissions are expected to be narrowly scoped to analysis behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage/help text is presented only in Chinese in a general-purpose shell script, with no indication that the skill is region-specific or that users can choose another language. This is a natural-language locale policy concern because it imposes a specific language without user opt-in.
- Content