Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Clawec API helper for Shopee keyword research, with disclosed external API use and no hidden persistence or destructive behavior.
Install this only if you intend to use Clawec for Shopee keyword research and are comfortable sending your selected site, category, filters, and CLAWEC_API_KEY-authenticated request to clawec.com. Keep the API key in an environment variable and review queries before running the helper script.
The skill clearly instructs use of shell commands and external API calls, but it declares no tool scope or allowed-tools restrictions. In an agent environment, that can enable broader-than-necessary shell access and make misuse or accidental command execution harder to contain.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/word/search" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $CLAWEC_API_KEY" \
-d '{"site":"tw","categoryId":100630,"sortType":3,"pageNo":1,"pageSize":10}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(json.dumps(body, ensure_ascii=False))
' "$SITE" "$CATEGORY_ID" "$SORT_TYPE" "$PAGE_NO" "$PAGE_SIZE" "$TIMEST" "$FILTERS_JSON")
curl -s -X POST "https://www.clawec.com/api/aigc/ec/shopee/data/word/search" \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $API_KEY" \
-d "$PAYLOAD"
This code performs a network POST to an external API and includes a bearer token from the CLAWEC_API_KEY environment variable, but the script provides no confirmation prompt, warning, or user-facing disclosure before transmitting the payload. For a code file, outbound transmission of user-supplied data and credentials should have some visible disclosure unless clearly covered elsewhere in the skill description.
The markdown states '默认中文报告', which imposes a language preference in the skill's output behavior. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless a language choice or justification is provided.
This markdown file presents all instructions, field descriptions, and usage guidance exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without offering user choice or documenting a justified locale constraint can be a policy issue.
The usage and error strings are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy concern because the skill does not offer language or locale choice and the file provides no justification for the restriction.