ClawHub
Back to skill

Security audit

amazon-market-entry-analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ZooData-powered Amazon market analysis tool that sends user-provided market research inputs to ZooData and uses a local API key, with no evidence of hidden exfiltration, destructive behavior, or persistence beyond disclosed temporary review workflow files.

Install only if you are comfortable sending Amazon market research inputs, ASINs, and review data to ZooData under your ZooData account. Use a dedicated ZOODATA_API_KEY with only the needed scope, avoid exposing unrelated legacy APICLAW credentials in the agent environment, and delete any /tmp review working directories after review fallback runs if the data is sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions while the content clearly describes access to environment variables, local files, and outbound network calls. That mismatch weakens policy enforcement and review visibility, making it easier for sensitive capabilities like `ZOODATA_API_KEY` access and external API communication to occur without explicit authorization tracking.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill is presented as a narrowly scoped market-entry analyzer, but the embedded CLI surface includes many additional capabilities such as raw review retrieval, prompt generation, credential diagnostics, historical/product lookups, and broader keyword research workflows. This kind of scope mismatch is dangerous because users, orchestrators, and reviewers may grant trust or invoke the skill under assumptions that do not cover the actual reachable functionality.

External Transmission

Medium
Category
Data Exfiltration
Content
# ─── Configuration ───────────────────────────────────────────────────────────

DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61
Confidence
97% confidence
Finding
https://api.zoodata.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL = _resolve_base_url()  # ZooData API base URL
BASE_URL_TRUSTED = _is_trusted_host(BASE_URL)  # gates Bearer-token transmission
API_DOCS = "https://api.zoodata.ai/api-docs"   # API documentation URL
MAX_RETRIES = 3       # Total attempt budget for ordinary failed requests
RETRY_DELAY = 2       # Initial retry delay in seconds; doubles on each retry
RATE_LIMIT_RETRIES = 4  # Total attempt budget for 429 rate limits
Confidence
97% confidence
Finding
https://api.zoodata.ai/

Env Variable Harvesting

High
Category
Data Exfiltration
Content
skill directory ships inside the published bundle, so a key placed there
    would be published publicly.
    """
    key = os.environ.get("ZOODATA_API_KEY", "").strip()
    if key:
        return key
Confidence
90% confidence
Finding
os.environ.get("ZOODATA_API_KEY

Env Variable Harvesting

High
Category
Data Exfiltration
Content
if key:
        return key

    key = os.environ.get("APICLAW_API_KEY", "").strip()
    if key:
        _warn_deprecated_source("APICLAW_API_KEY", "ZOODATA_API_KEY")
        return key
Confidence
88% confidence
Finding
os.environ.get("APICLAW_API_KEY

Session Persistence

Medium
Category
Rogue Agent
Content
d. `zoodata.py review-aggregate --reviews R --tagged T --clusters C`
        → consumerInsights output compatible with `/reviews/analysis`
  3. **Fallback caveats** (apply to the 4-step chain above — lessons from end-to-end validation):
     - **Working dir**: `WORK=/tmp/review_<ASIN>_$(date +%s) && mkdir -p $WORK`
     - **Step b CLI behavior**: `review-tag-prompt` RENDERS the prompt only; YOUR LLM produces the JSON. Render once to learn the schema, then produce tags for all N reviews in one in-context pass (don't call the CLI N times).
     - **Step c candidate extraction** (Python one-liner):
       `candidates = {d: sorted({el.strip().lower() for t in tagged for el in (t.get(d) or [])}) for d in DIMS}`
Confidence
72% confidence
Finding
mkdir -p $WORK` - **Step b CLI behavior**: `review-tag-prompt` RENDERS the prompt only; YOUR LLM produces the JSON. Render once to learn the schema, then produce tags for all N reviews in one in-

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.