Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only Shopee trend lookup integration that sends the user's query and Clawec API key to Clawec as expected for its purpose.
Before installing, users should be comfortable sending Shopee shop IDs, date ranges, optional category IDs, and their Clawec API key to Clawec. Store the API key in the environment rather than hardcoding it, and run the helper script only for intended Clawec shop-trend queries.
The skill instructs use of shell commands and a local script, but it does not declare any tool scope or allowed-tools restrictions. That creates an authorization gap where an agent may execute shell unexpectedly or more broadly than intended, increasing the risk of unsafe command execution in environments that honor skill-declared capabilities.
The skill explicitly transmits user-supplied business data and an API bearer token to an external third-party service. While that is expected for this integration, it is still a real data-transfer risk because shop identifiers, query parameters, and credentials leave the local trust boundary and could expose sensitive business intelligence if used without clear consent or minimization.
店铺整体趋势：
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/shop/trend" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLAWEC_API_KEY" \
-d '{"site":"tw","shopId":12345678,"granularity":1,"startDate":"2025-05-27","endDate":"2026-05-27"}'
The workflow and output guidance explicitly require Chinese output ('输出中文店铺趋势报告' and '默认中文报告') with no opt-in or alternative language option. This is a natural-language locale policy issue because it forces a specific language rather than allowing the user to choose.
This shell script reads a sensitive API key from an environment variable and transmits request data to a remote HTTPS endpoint via curl. There is no confirmation prompt, user-facing log/output, or explanatory comment/docstring in the file warning that the script will contact an external service using supplied parameters and credentials.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(json.dumps(body, ensure_ascii=False))
' "$SITE" "$SHOP_ID" "$GRANULARITY" "$START_DATE" "$END_DATE" "$CAT_ID" "$PAGE_NO" "$PAGE_SIZE")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/shop/trend" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-d "$PAYLOAD"
This markdown file presents all instructions and field descriptions exclusively in Chinese. Under the policy rule for natural-language constraints, forcing a single language without user opt-in can be a locale/language policy issue when no justification or alternative is provided.
The usage and validation messages are hard-coded in Chinese, which imposes a specific language on all users without any opt-in or alternative. This is a natural-language policy concern because the script does not offer locale selection or document that it is intentionally region-specific.