clawec-ozon-category-hot-ranking

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward ClawEC API helper for Ozon category ranking data, with expected external API use and no hidden persistence or destructive behavior.

Install only if you trust ClawEC with your API key and Ozon category query parameters. Prefer setting CLAWEC_API_KEY in a secure environment, avoid running the helper on shared hosts where other local users or monitoring tools can inspect process arguments, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/query.sh:29

Finding

Bearer Token Exposure Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/query.sh, lines 29–32
Vulnerability Type: Bearer token exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

curl -s -X POST "https://www.clawec.com/api/aigc/ec/ozon/data/category/hot-ranking" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$PAYLOAD"

Technical Analysis

The script expands CLAWEC_API_KEY into the curl argument vector as part of the Authorization header. Although HTTPS protects the request in transit, it does not prevent local disclosure of command-line arguments.

While curl is running, the expanded bearer token may be available through operating-system process inspection interfaces such as /proc/<pid>/cmdline, process-monitoring utilities, diagnostic agents, or command-line auditing systems. Exploitability depends on the host's process visibility controls and the attacker's local privileges, but the implementation unnecessarily exposes a reusable credential outside the destination request.

Attack Path

1. A victim sets CLAWEC_API_KEY and invokes scripts/query.sh.
2. The shell expands $API_KEY into the Authorization header passed in curl's argument vector.
3. A concurrent local user, process-monitoring agent, or compromised process with sufficient process-inspection access reads the curl command line.
4. The observer extracts the bearer token from the header.
5. The observer submits authenticated requests to the ClawEC API using the stolen token until it expires or is revoked.

Impact Assessment

Successful exploitation discloses the victim's ClawEC bearer token. An attacker can obtain the same ClawEC API authorization granted to that token and make unauthorized requests within its server-side permission scope. This does not directly grant operating-system privilege escalation or persistence, but it can cause unauthorized API use, account-level data exposure, quota ...[truncated 62 chars]

Remediation

View remediation

Remediation Suggestions

Avoid passing secrets directly in process command-line arguments.

1. Supply the sensitive header through a protected temporary curl configuration file or another mechanism that does not place the token in the process argument vector.
2. Create temporary files with restrictive permissions by setting umask 077.
3. Register a shell trap to delete temporary credential material on normal exit and interruption.
4. Do not enable shell tracing with set -x while credentials are handled.
5. Ensure logs and error-reporting systems redact Authorization headers.
6. Rotate the API key if process monitoring, diagnostic collection, or another local observer may already have captured it.
7. Where supported, use short-lived, narrowly scoped tokens to reduce the impact of disclosure.

A hardened approach can pass a curl configuration through a private file descriptor or a mode-0600 temporary file, ensuring that the authorization value does not appear in ordinary process arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents shell-based execution paths (curl and bash scripts/query.sh) but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can cause overbroad execution privileges or unclear approval requirements, increasing the chance that shell/network actions occur without appropriate control.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented curl invocation sends credentials (Authorization: Bearer $CLAWEC_API_KEY) and query data to an external endpoint. External transmission is expected for this API skill, but it remains security-relevant because it exposes secrets and user request data to a third party and therefore requires explicit trust, consent, and handling safeguards.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

调用

bash

curl -s -X POST "https://www.clawec.com/api/aigc/ec/ozon/data/category/hot-ranking" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $CLAWEC_API_KEY" \
  -d '{"categoryId":17027489,"period":"SEVEN_DAY","pageNo":1,"pageSize":15,"sortField":"GMV","sortDirection":"DESC","language":"CH"}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow and output sections explicitly require Chinese output and a default Chinese report. This is a natural-language locale policy constraint, and the file does not offer the user a language choice or frame the restriction as an explicitly justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uses Chinese-only usage/error messages and defaults the request language to "CH", which imposes a specific language/locale without offering a choice or documenting a justified regional restriction. This matches the policy category for language or locale constraints lacking user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/query.sh (reported line 30)May include surrounding context.

sh

print(json.dumps(body))
' "$CATEGORY_ID" "$PERIOD" "$PAGE_NO" "$PAGE_SIZE" "$SORT_FIELD" "$SORT_DIRECTION" "$LANGUAGE" "$UPDATE_PERIOD")

curl -s -X POST "https://www.clawec.com/api/aigc/ec/ozon/data/category/hot-ranking" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$PAYLOAD"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This shell script performs an HTTP POST to an external service and includes both structured request data and a bearer token from an environment variable, but there is no confirmation prompt, logging, or comment disclosing that data will be transmitted off-system. For code files, outbound network transmission and credential use should have some visible user warning unless clearly documented as part of the skill's stated purpose, which is not evident from this file alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to send an API key and user-supplied query parameters to an external service but does not clearly warn the user that data will leave the local environment. This creates a transparency and consent issue, especially if category queries or account-linked credentials are sensitive in the deployment context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The schema specifies language defaults to CH, and later guidance says to prefer Chinese category names when displaying results. This creates a locale preference in natural-language documentation without indicating that users can choose their preferred language or that the default is justified by a region-specific constraint.

Content

No source excerpt is available for this finding.