Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed ClawEC API helper for querying Shopee category trend data, with expected external API use and no hidden persistence or unrelated access.
Install only if you are comfortable sending Shopee category trend query parameters to clawec.com using your CLAWEC_API_KEY. Keep that API key in environment storage, do not hardcode it, and avoid entering sensitive business data beyond what the query requires.
The skill instructs use of shell commands and a local script, but it declares no explicit tool scope or permissions boundary. In an agent environment, this can lead to over-broad execution capability, making it easier for the skill to invoke shell unexpectedly or in contexts where such access should have been denied.
The skill sends user-supplied query parameters and an API bearer token to an external third-party service. External transmission is expected for this skill's purpose, but it still creates a real data egress boundary where sensitive inputs, usage metadata, or credentials could be exposed if users are not informed or if the destination is not tightly constrained.
单站点 + 自然月：
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/category/trend" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLAWEC_API_KEY" \
-d '{"sites":["tw"],"catId":100630,"granularity":1,"startDate":"2026-01-01","endDate":"2026-06-26"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(json.dumps(body, ensure_ascii=False))
' "$SITES" "$CAT_ID" "$GRANULARITY" "$START_DATE" "$END_DATE" "$PRODUCT_TYPE" "$LOCATION")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/category/trend" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-d "$PAYLOAD"
This code performs a network POST request and includes an Authorization header derived from a sensitive environment variable. The file contains no comment, echo/print output, or confirmation indicating that user-supplied query parameters and credentials will be transmitted to an external service.
The markdown states '默认中文报告', which imposes a specific language choice as the default behavior. Under the policy, language constraints should either offer user choice or be explicitly justified as region-specific; this file does not provide such an opt-in mechanism at the output instruction point.
The script's user-facing usage and environment-variable error messages are written only in Chinese, which imposes a specific language on all users. There is no opt-in, fallback, or documented locale constraint justifying the restriction.