clawec-ozon-product-search

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:16 AM UTC
• Version: 1.0.3

Overview

This skill is a straightforward Ozon product-search helper that sends user-provided keywords to the disclosed ClawEC API using a user-supplied API key.

Install only if you are comfortable sending searched keywords to ClawEC and using a ClawEC API key from your environment. Do not put secrets in commands or files, and review ClawEC's service terms and data handling if the keywords reveal sensitive business plans.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill demonstrates shell execution via curl/bash but does not declare any tool scope or allowed-tools restrictions. This increases the attack surface because an agent may invoke shell unexpectedly or more broadly than intended, making command execution harder to govern and audit.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 调用

```bash
curl -s -X POST "https://www.clawec.com/api/aigc/ec/ozon_search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $CLAWEC_API_KEY" \
  -d '{"keyword":"蓝牙耳机"}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

PAYLOAD=$(python3 -c 'import json,sys; print(json.dumps({"keyword": sys.argv[1]}))' "$KEYWORD")

curl -s -X POST "https://www.clawec.com/api/aigc/ec/ozon_search" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $API_KEY" \
  -d "$PAYLOAD"

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code performs an HTTP POST and attaches a bearer token from the CLAWEC_API_KEY environment variable, but the script provides no visible notice, logging, or comment explaining that it will transmit data to an external service using credentials. For code files, outbound network calls and credential usage should have some user disclosure unless clearly documented elsewhere, which is not evident in this file.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The markdown states '默认中文摘要' (default Chinese summary), which imposes a language preference in the skill behavior. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific; this file does not provide such an opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This markdown file is natural-language documentation, and all headings and field descriptions are presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a language/locale policy violation when no justification or alternative is provided.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The usage and environment-variable error messages are hard-coded in Chinese, which imposes a specific language on all users. The policy allows locale constraints only when users can opt in or when the restriction is clearly documented and justified, neither of which is shown here.

Static analysis

No suspicious patterns detected.