clawec-amazon-keyword-selection

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.0.0

Overview

The skill sends Amazon keyword research queries to ClawEC using an API key, with no evidence of hidden persistence, destructive actions, or unrelated data collection.

Install this only if you trust ClawEC and are comfortable sending Amazon keyword research parameters to its API under your CLAWEC_API_KEY. Avoid sharing one API key among mutually untrusted users, because the helper scripts can read recent keyword-search logs for that account and the polling helper may pick the wrong similar record during concurrent searches.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search_and_poll.sh:111

Finding

Ambiguous Asynchronous Search Result Correlation

Content

View full analysis

Vulnerability Details

File Location: scripts/search_and_poll.sh, lines 111–119
Vulnerability Type: Incorrect asynchronous result correlation
Risk Level: Medium

Vulnerable Code

python

unwrap_data(run_json(cmd))
target = {"region": region, "month": month, "keyword": keyword.strip(), "aiInterpret": ai}
log_id = None
for _ in range(10):
    for item in (unwrap_data(run_json([logs_sh,"1","20"])).get("items") or []):
        p = item.get("param") or {}
        if (p.get("region") or "US") == region and str(p.get("month") or "") == month and (p.get("keyword") or "").strip() == keyword.strip():
            log_id = item.get("id"); break
    if log_id: break

Technical Analysis

The script discards the submitted search response and attempts to discover the corresponding record by querying account history. It matches records using only region, month, and keyword.

This comparison omits other submitted parameters, including departments and aiInterpret. It also does not verify a creation timestamp, unique request identifier, or record ownership beyond possession of the shared API credential. Although a target object includes aiInterpret, that object is never used.

Consequently, concurrent or repeated requests with identical matched fields can be correlated with the wrong history entry. The first partially matching record among the latest 20 entries is accepted without ambiguity detection.

Attack Path

1. Two users or processes operate with the same CLAWEC_API_KEY.
2. They submit searches with the same region, month, and keyword but different departments or AI interpretation settings.
3. Each process queries the latest 20 search-history records.
4. The matching loop selects the first record whose region, month, and keyword match.
5. One process can select the other process's record ID.
6. The selected record's keyword results and AI analysis are fetched and returned to the wrong caller.

Exploitation requires access ...[truncated 561 chars]

Remediation

View remediation

Remediation Suggestions

1. Capture and use an immutable record or job identifier returned directly by the search endpoint.
2. If the endpoint does not return an identifier, add a unique client-generated request ID and require the service to preserve and return it.
3. As a temporary fallback, compare every submitted parameter, including normalized departments and aiInterpret, and require the record creation time to be later than the local submission time.
4. Detect multiple matching records and fail safely instead of selecting the first one.
5. Avoid sharing API credentials among mutually untrusted users. Use separate credentials or server-side tenant isolation where supported.
6. Add concurrency tests covering simultaneous searches with identical region, month, and keyword values but different departments and AI settings.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is keyword research, but the workflow also accesses search history and log detail endpoints, including prior records and AI analysis content. That undeclared data-reading capability can expose historical user queries or outputs beyond the current task, violating least surprise and potentially leaking sensitive commercial research data.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/search_and_poll.sh (reported line 36)May include surrounding context.

sh

script_dir = sys.argv[3]
args = sys.argv[4:]

env = os.environ.copy()
search_sh = os.path.join(script_dir, "search.sh")
logs_sh = os.path.join(script_dir, "logs.sh")
detail_sh = os.path.join(script_dir, "log_detail.sh")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents use of environment variables and shell scripts/curl, but it does not declare any explicit tool scope or permissions boundary. This creates an authorization gap where an agent may invoke shell or read env secrets without the skill manifest making those capabilities visible for review or restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

| JP | 日本 |

bash

curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/keyword_research/search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $CLAWEC_API_KEY" \
  -d '{"region":"US","month":"202505","keyword":"yoga mat","aiInterpret":true}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instruction explicitly says to produce a Chinese summary ("整理中文摘要"), which imposes a language choice on users. The file does not indicate that Chinese is optional or that the user can choose another language, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script performs an HTTP request to an external service using curl and transmits the provided log ID plus an Authorization header derived from an environment variable. There is no user-facing print, comment, or other disclosure in this file warning that data will be sent off-system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code reads a sensitive credential from the environment and immediately uses it in a curl request to an external service. There is no confirmation prompt, logging, comment, or other user-facing disclosure in the script warning that credentials and request parameters will be transmitted over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.sh (reported line 28)May include surrounding context.

sh

if kw.strip(): body["keyword"]=kw.strip()
print(json.dumps(body, ensure_ascii=False))
' "$REGION" "$MONTH" "$DEPARTMENTS" "$KEYWORD" "$AI")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/keyword_research/search" -H "Content-Type: application/json" -H "Authorization: Bearer $API_KEY" -d "$PAYLOAD"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs an HTTP POST to an external endpoint using the Authorization bearer token from CLAWEC_API_KEY and transmits user-provided region, month, departments, keyword, and AI interpretation settings. There is no confirmation prompt, print/log disclosure, or comment/docstring warning users that their inputs and credential will be used in a remote API request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The usage text presents the environment-variable documentation only in Chinese, which imposes a specific language on users without any opt-in or stated regional constraint. Under the policy rule, language-specific instructions should either offer choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script's only user-facing messages are in Chinese ("用法" and "请设置环境变量"), which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy issue because the file does not provide a language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The script reads the sensitive environment variable CLAWEC_API_KEY and uses it for authentication, but the file provides no explanatory comment or user-facing notice about credential usage beyond requiring the variable to be set. Under the rule, access to sensitive credentials should have some disclosure when not otherwise documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The error message for a missing environment variable is hard-coded in Chinese ("请设置环境变量 CLAWEC_API_KEY"). This imposes a specific language choice on all users without offering an alternative or documenting a locale-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Both the usage text and the missing-environment-variable message are hardcoded in Chinese, which imposes a specific language on all users regardless of preference. This is a natural-language policy issue because the script does not provide any language selection or opt-in mechanism.

Content

No source excerpt is available for this finding.