clawec-amazon-category-research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed ClawEC API helper for Amazon category research, with ordinary API-key and network-use risks but no evidence of hidden or destructive behavior.

Install only if you intend to use ClawEC for Amazon category research and are comfortable sending marketplace, category path, month, and analysis options to ClawEC using your CLAWEC_API_KEY. Use a least-privilege API key if available and avoid entering proprietary category targets unless ClawEC's data-handling terms are acceptable to you.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose says the skill analyzes Amazon submarkets/categories through the ClawEC API. However, the actual code only fetches search logs from a search/logs endpoint with pagination parameters. That is a materially different primary behavior: log retrieval/history access rather than niche analysis itself. No analysis, market statistics computation, concentration breakdown, or AI interpretation is present in the supplied code chunk. Therefore the description does not accurately represent the observed behavior.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_and_poll.sh (reported line 36)May include surrounding context.

sh

script_dir = sys.argv[3]
args = sys.argv[4:]

env = os.environ.copy()
search_sh = os.path.join(script_dir, "search.sh")
logs_sh = os.path.join(script_dir, "logs.sh")
detail_sh = os.path.join(script_dir, "log_detail.sh")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents use of environment variables and shell commands but does not declare any explicit tool scope or permissions boundary. In an agent environment, this increases the chance of over-broad execution context, secret access, or unintended command execution because reviewers and runtime policy cannot easily constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

L003 写明“在用户需要 category research、细分市场研究、类目分析时使用”，其中“细分市场研究”“类目分析”属于较通用业务表达，未说明具体平台、任务前提或排除条件。对于清单/描述类文件，这种缺少约束的触发说明可能导致技能在更宽泛的研究类请求中被误调用。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

该文件整体说明与输出建议均以中文固定呈现，未声明可根据用户偏好切换语言，也未提供显式的语言选择。按自然语言政策要求，若技能默认或强制特定语言而无用户 opt-in，可能构成语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill sends user-supplied research parameters to a third-party API but does not clearly disclose that those inputs will leave the local agent context. This creates a data transparency and privacy risk, especially if users provide sensitive marketplace strategy, proprietary category targets, or account-linked identifiers while expecting only local processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill explicitly transmits data and an authorization bearer token to an external service. External transmission is expected for an API integration, but it remains security-relevant because it exposes user inputs to a third party and creates secret-handling risk if shell usage, logging, or error output leaks the API key.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

| JP | 日本 |

bash

curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/category_research/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $CLAWEC_API_KEY" \
  -d '{"marketplace":"US","nodeIdPath":"2619525011:3741271","month":"202505","marketStatistics":true,"aiInterpret":true}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script takes user-provided category parameters, builds a JSON payload, and transmits it along with a bearer API credential to an external service without any explicit user-facing disclosure at runtime. In an agent-skill context, this can cause unanticipated exfiltration of user-supplied business data and use of the operator's credential, especially if invoked automatically by a higher-level agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The script performs an outbound POST to a third-party endpoint and includes both user-derived content and an Authorization bearer token. In this skill's context, external transmission is expected for functionality, but it remains security-relevant because users may not realize their inputs are sent off-box and credentialed requests to a remote service can disclose sensitive research targets or metadata.

Content

Scanner excerpt · scripts/search.sh (reported line 30)May include surrounding context.

sh

body={"marketplace":m or "US","nodeIdPath":node,"month":month,"marketStatistics":ms=="true","productConcentration":pc=="true","brandConcentration":bc=="true","sellerConcentration":sc=="true","aiInterpret":ai=="true"}
print(json.dumps(body, ensure_ascii=False))
' "$MARKETPLACE" "$NODE" "$MONTH" "$MS" "$PC" "$BC" "$SC" "$AI")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/category_research/search" -H "Content-Type: application/json" -H "Authorization: Bearer $API_KEY" -d "$PAYLOAD"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage and error messages in the parameter and environment-variable checks are written only in Chinese ("用法" and "请设置环境变量"). This imposes a specific language on users without opt-in or an alternative locale, which matches the language-policy violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The shell parameter-expansion error message at L06 is hard-coded in Chinese ("请设置环境变量 CLAWEC_API_KEY"). This creates a language/locale policy issue because the script imposes a specific language on users without opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage string is presented only in Chinese, which forces a specific language for user interaction without any opt-in or indication that the tool is intentionally region-specific. This is a natural-language policy concern because it constrains the user experience to one locale by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The environment-variable error message is emitted only in Chinese, again imposing a specific language without user opt-in. No nearby documentation in this file explains a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The user-facing usage text is presented only in Chinese in the environment-variable section, which imposes a specific language on users. Under the policy, locale or language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.