ClawHub
Back to skill

Security audit

amazon-listing-audit-pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ZooData-powered Amazon listing audit tool with expected API, credential, and local-file behavior for its purpose.

Install only if you are comfortable sending ASINs, keywords, category paths, marketplace/date values, and numeric filters to ZooData and spending ZooData credits for audits. Prefer ZOODATA_API_KEY in the environment over ~/.zoodata/config.json, especially on shared machines.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and relies on capabilities including environment access, local file reads, network access, and shell execution, but does not declare permissions explicitly. This weakens sandboxing and user awareness, making it easier for sensitive operations like API-key access or command execution to occur without clear policy review.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented purpose is a listing-audit skill, but the content reveals substantially broader functionality including standalone market intelligence, opportunity discovery, raw review retrieval, prompt rendering, and credential/self-check operations. This mismatch can cause users or orchestrators to invoke a skill under overly narrow trust assumptions while it actually has wider data access and execution behavior.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The skill states it may read ~/.zoodata/config.json as a credential source, but this local credential access is not prominently disclosed as a sensitive behavior. Even if limited to its own config, undisclosed reads of files in the user's home directory reduce transparency and can surprise users in environments where local secrets are tightly controlled.

Session Persistence

Medium
Category
Rogue Agent
Content
print("    export ZOODATA_API_KEY='hms_live_yourkey'", file=sys.stderr)
    print("", file=sys.stderr)
    print("  Method 2: User-home config (persistent, shared across all skills)", file=sys.stderr)
    print("    mkdir -p ~/.zoodata && chmod 700 ~/.zoodata", file=sys.stderr)
    print('    (umask 077; echo \'{"api_key":"hms_live_yourkey"}\' > ~/.zoodata/config.json)', file=sys.stderr)
    print("    # keep the file private (0600) — it holds a bearer credential", file=sys.stderr)
    print("", file=sys.stderr)
Confidence
73% confidence
Finding
mkdir -p ~/.zoodata && chmod 700 ~/.zoodata", file=sys.stderr) print(' (umask 077; echo \'{"api_key":"hms_live_yourkey"}\' > ~/.zoodata

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.