Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Clawec API helper for Shopee keyword rankings; it sends query parameters and an API key to the disclosed Clawec endpoint, with no hidden persistence or unrelated behavior found.
Install only if you intend to use Clawec for Shopee keyword research. Store CLAWEC_API_KEY as an environment variable, avoid pasting unrelated sensitive data into queries, and remember that ranking parameters and your API credential are sent to Clawec when the skill runs.
The skill includes executable shell usage examples and script invocation guidance but does not declare any tool scope restrictions such as allowed tools or permissions. In an agent environment, that mismatch can lead to overly broad execution capability, making accidental or unauthorized shell use more likely than intended by the skill’s narrowly scoped purpose.
The skill instructs the agent to send data and an authorization bearer token to an external third-party API endpoint. External transmission is expected for this integration, but it still creates real risk because user-supplied query data and secrets may be exposed to a remote service, and the skill does not document consent boundaries, data minimization, or domain/tool restrictions.
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/word/ranking" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLAWEC_API_KEY" \
-d '{"site":"tw","categoryId":100630,"sortField":1,"period":3,"borderType":0,"pageNo":1,"pageSize":10}'
The document explicitly states '默认中文报告', which imposes a language preference in the skill's output behavior. Under the policy, language constraints should offer user choice or be clearly justified as region-specific; this file does not provide such opt-in or justification.
This markdown file contains user-facing natural-language documentation exclusively in Chinese, including headings, field descriptions, and parsing guidance. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(json.dumps(body, ensure_ascii=False))
' "$SITE" "$CATEGORY_ID" "$SORT_FIELD" "$PERIOD" "$BORDER_TYPE" "$PAGE_NO" "$PAGE_SIZE" "$DATE")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/word/ranking" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-d "$PAYLOAD"
This shell script sends user-supplied parameters to an external HTTPS endpoint and includes a bearer token from an environment variable in the request. Although the code is straightforward, there is no visible confirmation prompt, logging, or explanatory comment/docstring warning the user that data will be transmitted off-system using their API credential.
The usage and environment-variable error messages are written only in Chinese, which imposes a specific language on all users. There is no opt-in, alternative locale, or documentation indicating that this skill is intentionally limited to Chinese-speaking users.