Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
声明描述的是一个用于亚马逊选品调研的功能，核心应是根据调研条件发起产品研究查询并返回分析结果。但实际代码仅访问搜索日志接口，行为是读取历史日志列表，而不是执行产品调研本身。它既没有实现声明中的关键输入参数（市场、月份、类目、关键词、fastMode），也没有体现 AI 解读功能。因此代码的实际主要用途与声明的主要用途存在实质性不一致。
- Content
Security audit
clawec-amazon-product-research
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed wrapper around ClawEC's Amazon product-research API, using a user-provided API key and product-search parameters in a purpose-aligned way.
Install only if you are comfortable sending Amazon product-research queries and your CLAWEC_API_KEY to Clawec. Use a dedicated API key if possible, avoid entering highly sensitive proprietary search terms unless appropriate, and keep the key in the environment rather than hardcoding it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
sh script_dir = sys.argv[3] args = sys.argv[4:] env = os.environ.copy() search_sh = os.path.join(script_dir, "search.sh") logs_sh = os.path.join(script_dir, "logs.sh") detail_sh = os.path.join(script_dir, "log_detail.sh")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs use of environment variables and shell/curl, but it does not declare any tool scope or permissions boundary. That creates an authorization gap: an agent may invoke shell or access env-backed secrets without an explicit least-privilege declaration, increasing the chance of unintended secret use or command execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The skill sends user-supplied research parameters and an authorization bearer token to an external third-party API. External transmission is expected for this skill’s purpose, but it is still security-relevant because sensitive business queries, usage metadata, and credentials are involved; without explicit consent and scoping, this can expose proprietary research activity or misuse API secrets.
- Content
| beginner | 新手推荐 |
bash curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/product_research/search" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $CLAWEC_API_KEY" \ -d '{"marketplace":"US","month":"202505","keyword":"phone case","matchType":2,"page":1,"size":50,"nodeIdPathEqual":false,"aiInterpret":true}'
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow explicitly instructs the skill to '输出中文摘要', which imposes a specific language on all users. This is a natural-language policy concern because the file does not offer a language choice or state that Chinese output is optional or context-limited.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file performs a network call using curl and sends the provided log ID to a remote API while authenticating with a sensitive environment variable. There is no confirmation prompt, logging, comment, or other user-facing disclosure in the script explaining that data will be sent off-system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh print(json.dumps(body, ensure_ascii=False)) ' "$MARKETPLACE" "$MONTH" "$KEYWORD" "$NODE_PATHS" "$FAST_MODE" "$AI") curl -s -X POST "https://www.clawec.com/api/aigc/ec/amazon/product_research/search" -H "Content-Type: application/json" -H "Authorization: Bearer $API_KEY" -d "$PAYLOAD"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell script performs an HTTP POST to an external service and includes both the generated payload and a bearer token derived from an environment variable. There is no confirmation prompt, visible logging, or comment/docstring warning the user that their inputs and credential will be transmitted off-system.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The usage and error messages are hard-coded in Chinese, which imposes a specific language on users without opt-in. Under the policy, locale-specific behavior should either offer a choice or clearly document why the constraint is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The required-environment-variable error text is hardcoded in Chinese: "请设置环境变量 CLAWEC_API_KEY". This is a natural-language locale choice imposed on all users, with no indication that the skill is region-specific or that users can select their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
All visible usage instructions and option descriptions are written in Chinese, with no alternative language or mechanism for user language selection. This can violate language/locale policy when a skill imposes a specific language without offering opt-in or choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The user-facing usage section is presented only in Chinese ("环境变量", related descriptions) with no indication of language choice or opt-in. This can violate language/locale policy when a skill forces a specific language for user interaction without offering alternatives.
- Content