Security audit
Security checks for vulnerabilities and agentic risk
The skill is a straightforward Clawec API helper for Shopee item lookups, with expected external API and API-key use and no hidden persistence or destructive behavior.
Install this skill only if you are comfortable sharing the Shopee item IDs, site/date query, and your Clawec API key with Clawec. Keep the key in an environment variable, avoid sending sensitive research targets unnecessarily, and review the script before running it in automation.
The skill includes executable shell usage examples and an accompanying script invocation, but it does not declare any tool scope or permissions boundary. In an agent environment, missing explicit tool restrictions can cause the runtime to grant broader execution capability than users expect, increasing the chance of unintended command execution or unsafe automation.
The skill instructs the agent to send product identifiers and an API credential to a third-party service but does not clearly warn the user that their query data will leave the host environment. This creates a transparency and privacy risk because users may provide sensitive business intelligence or proprietary research targets without informed consent.
The skill explicitly demonstrates transmitting user-supplied parameters and a bearer token to an external API endpoint. While external API use is the purpose of the skill, it still represents a real security boundary crossing: sensitive identifiers, usage patterns, and credentials are exposed to a third party, and the shell-based example increases the risk of unsafe handling in agent runtimes.
单个商品：
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/item/detail" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLAWEC_API_KEY" \
-d '{"site":"tw","itemIds":"1234567890"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(json.dumps(body, ensure_ascii=False))
' "$SITE" "$ITEM_IDS" "$TIMEST")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/item/detail" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-d "$PAYLOAD"
This shell script sends user-supplied site and item ID data to an external HTTPS endpoint and includes a bearer token from an environment variable in the request. The script provides no comment, echo/log message, or confirmation indicating that data will be transmitted off-host or that a credential will be used, which matches the missing-warning criteria for code files.
The file states '默认中文报告', which sets Chinese as the default output language. Under the policy, locale constraints should either be user-selectable or clearly justified; this file does not offer an opt-in choice or explain why Chinese is required.
This file’s headings, field descriptions, and guidance are all presented only in Chinese, which effectively forces a specific language for users of the skill documentation. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.
The usage and error messages embedded in the script are written in Chinese only, which imposes a specific language on all users. The file does not provide any opt-in, fallback, or documented locale constraint that would justify the restriction.