Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
APM 상품 관리 API
v1.0.0APM 플랫폼의 상품 관리 API 모음. 관리자용 상품 추가/삭제/수정/가격·재고·할인 관리 17개 + 사용자용 상품 조회/검색/카테고리/추천/유사 상품/이미지 검색 16개, 총 33개 엔드포인트. 모든 엔드포인트는 먼저 ids_*_login으로 access_token 획득 후 a...
⭐ 0· 25·0 current·0 all-time
by@apmzoom
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (APM 상품 관리 API) matches the documented endpoints: read/write product operations against a single API gateway. Requested items (just APM_USER_TOKEN) are plausible for an HTTP API client. One small mismatch: the docs reference separate login flows (ids_*_login for seller/user tokens) but the skill declares only a single primary environment variable (APM_USER_TOKEN) — it is unclear how seller vs user tokens should be managed.
Instruction Scope
Instructions tell the agent to call the external Base URL with an authcode header and to compute MD5-based signatures per-endpoint. That is expected for an API doc skill. Concerns: (1) the SKILL docs refer to performing 'ids_*_login' to acquire tokens but the login endpoints are not included in the package — the skill therefore expects a pre-provisioned token in the environment, which must be provided externally; (2) at least one endpoint file (gds_m_delgoods) contains an inconsistency: text describes a POST body but the Quick Reference lists Method: GET — this ambiguity could cause incorrect calls; (3) headers and signature scheme require constructing and transmitting the token ('HH ' + token) to an external host — nothing in the instructions attempts to read unrelated local files, but the agent will transmit whatever token is in APM_USER_TOKEN to the documented host.
Install Mechanism
No install spec and no code files — instruction-only skill. This is low-risk in terms of installation because nothing is written to disk or downloaded.
Credentials
Only one environment variable (APM_USER_TOKEN) is requested, which is proportionate for an API client. However, the APIs include both seller (관리자) and user endpoints; the docs imply different login flows/roles but do not declare separate env vars for seller vs user tokens. That ambiguity increases the chance of accidentally providing a token with broader privileges than intended.
Persistence & Privilege
The skill is not always-enabled and does not request system config paths or other privileges. It does not modify other skills' configurations. Autonomous invocation is allowed (default) but not flagged by itself.
What to consider before installing
This skill is an instruction-only API reference for an APM product-management back end and requires you to supply an access token in the APM_USER_TOKEN environment variable. Before installing or using it: (1) verify you trust the Base URL (https://44k2t5n59e.execute-api.ap-northeast-2.amazonaws.com) and the package homepage; (2) avoid placing long-lived or highly privileged credentials in a global environment variable — use a scoped/ephemeral token if possible; (3) confirm whether you need separate seller and user tokens (the docs mention both roles but only one env var is declared); (4) watch for the documented inconsistencies (e.g., gds_m_delgoods shows POST in the flow but lists GET in Quick Reference) and test calls with a non-production account first; and (5) consider limiting the token's permissions to the minimum needed (read-only for discovery, separate write token for changes) and monitoring activity on that token.Like a lobster shell, security has layers — review code before you run it.
latestvk97djjvq81f9dhkfe9hpk4ddvx851sr7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvAPM_USER_TOKEN
Primary envAPM_USER_TOKEN