ClawHub
Back to skill

Security audit

amazon-pricing-command-center

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated ZooData pricing-analysis purpose, but it needs review because an API key can be sent over plaintext HTTP if the base URL override is set unsafely.

Install only if you trust ZooData and the publisher with submitted ASINs, keywords, category paths, and API-credit usage. Do not set ZOODATA_BASE_URL unless you fully control it; it should remain the default HTTPS ZooData endpoint. Prefer a pinned or verified release instead of the README's floating npx install command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zoodata.py:55
Finding

Bearer API Credential May Be Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:20
Finding

Unpinned Remote Installation Chain Can Deliver Unaudited Skill Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A second description-behavior mismatch is present: the skill promises explicit RAISE/HOLD/LOWER recommendations, profit simulation, and batch category-grouped workflows, but those controls are not evidenced in the supplied implementation while broader research and probing features are. This can mislead operators into trusting generated outputs as deterministic business logic and may mask broader API access than intended, creating risk of misuse, overcollection, and unexpected spend.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A second description-behavior mismatch is present: the skill promises explicit RAISE/HOLD/LOWER recommendations, profit simulation, and batch category-grouped workflows, but those controls are not evidenced in the supplied implementation while broader research and probing features are. This can mislead operators into trusting generated outputs as deterministic business logic and may mask broader API access than intended, creating risk of misuse, overcollection, and unexpected spend.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The README instructs users to install and run the skill via npx skills add SerendipityOneInc/ZooData-Skills without pinning a specific version or immutable package reference. This creates a supply-chain risk: if the referenced package is updated maliciously, compromised, or unexpectedly changed, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises access to environment variables, file reads, network, and shell execution but does not declare explicit tool scope restrictions in the manifest. That increases the attack surface because the agent runtime may grant broader capabilities than users or reviewers expect, enabling unintended access to secrets, local files, or arbitrary command execution if the skill instructions or bundled scripts are abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad enough to match ordinary pricing or competitor questions, which can cause the skill to activate in situations where the user did not intend to invoke an external API-backed workflow. In this context, unintended activation matters because the skill can read credentials, make network calls, and consume paid API credits, so over-broad routing increases the chance of unnecessary data disclosure and cost-incurring actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a focused pricing strategy engine for Amazon sellers that auto-detects category, analyzes pricing landscape, and returns RAISE/HOLD/LOWER guidance for supplied ASINs. This file, however, documents and implements many additional command families such as product opportunity discovery, market-entry analysis, listing audit, review deep-dive, keyword intelligence, and raw review extraction, which materially exceed a narrow pricing-command-center scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/reference.md (reported line 25)May include surrounding context.

md
# ─── Configuration ───────────────────────────────────────────────────────────

DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/zoodata.py (reported line 50)May include surrounding context.

python
# ─── Configuration ───────────────────────────────────────────────────────────

DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/zoodata.py (reported line 87)May include surrounding context.

python
# ─── Configuration ───────────────────────────────────────────────────────────

DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section adds a full prompt-as-data review-analysis toolkit: fetching raw reviews, rendering tagging/reduction prompts for another LLM, and aggregating review insights. While review sentiment can be tangentially useful, exposing general-purpose review-mining and LLM prompt generation is not a direct or obvious requirement of a skill whose declared purpose is pricing strategy and raise/hold/lower recommendations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The review-tag prompt explicitly instructs the downstream model that output must be in English and to translate non-English text before extracting. This imposes a fixed language policy in natural-language instructions without offering the user a language choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The keyword-detail, keyword-market-profile, keyword-trend, keyword-extends, SERP, competitor-keyword, and traffic-term timeline commands provide keyword research and search-visibility analytics. Those are broader Amazon SEO/market-research capabilities, not a direct and necessary implementation detail of generating pricing signals for one or more ASINs as described in the manifest.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/zoodata.py (reported line 1234)May include surrounding context.

python
"priceMin", "priceMax", "ratingMin", "ratingMax", "bsrMin", "bsrMax",
                 "salesGrowthRateMin", "salesGrowthRateMax", "sellerCountMin", "sellerCountMax",
                 "variantCountMin", "variantCountMax"):
        val = getattr(args, attr.replace("Min", "_min").replace("Max", "_max")
                      .replace("monthly", "monthly_").replace("review", "review_")
                      .replace("sales", "sales_").replace("Growth", "_growth_")
                      .replace("Rate", "rate_").replace("price", "price_")