Keepa Api

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:27 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate Keepa API client, but it handles your API key in ways that can expose it, so it should be reviewed before installing.

Install only if you are comfortable sending your Keepa API key and product queries to Keepa. Prefer using an environment variable over a project CONFIG.md file, keep any config file out of repositories and backups, restrict its permissions, avoid running examples with real keys in logged terminals or CI output, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/keepa.sh:122
• Finding: Keepa API Key Exposed in Process Arguments and URL Logging<![CDATA[ ## Vulnerability Details **File Location**: `scripts/keepa.sh`, lines 122-126 **Vulnerability Type**: API credential exposure through command-line arguments and URL query parameters **Risk Level**: Medium ### Vulnerable Code ```bash keepa_request() { local endpoint="$1" local params="$2" local url="https://api.keepa.com/${endpoint}?key=${KEEPA_API_KEY}${params}" curl -s --compressed "$url" } ``` ### Technical Analysis The Keepa API key is embedded directly into the request URL passed to `curl`. Although HTTPS encrypts the request in transit, it does not prevent exposure through local process arguments or components that record complete URLs. While `curl` is running, the URL may be visible to other processes or users with sufficient process-inspection permissions. Complete URLs may also be captured by shell tracing, debugging systems, process monitoring, crash diagnostics, proxies, or application logs. The request is restricted to the legitimate Keepa HTTPS endpoint, and no evidence of intentional credential exfiltration was found. Nevertheless, placing a reusable secret in a command-line URL unnecessarily increases its exposure surface. ### Attack Path 1. A victim configures a valid Keepa API key and invokes the script. 2. `keepa_request` constructs a URL containing `key=${KEEPA_API_KEY}`. 3. The script launches `curl` with that complete URL as a command-line argument. 4. A local observer, diagnostic tool, or logging component captures the process arguments or URL. 5. The observer extracts the API key. 6. The exposed key is reused to make unauthorized Keepa API requests. This path requires local process visibility, access to relevant diagnostic data, or access to a component that records URLs. ### Impact Assessment An attacker who obtains the key can authenticate to Keepa as the affected user and consume the account's API tokens or quota. This may cause unexpected charges, quota exhaustion, service disruption, or access to A ...[truncated 197 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. If supported by Keepa, transmit the credential in an authorization header rather than the query string. 2. If Keepa requires a query parameter, prevent the secret from appearing directly in `curl` process arguments. Consider supplying sensitive curl options through a protected configuration stream or file descriptor. 3. Ensure any temporary credential material is created with restrictive permissions, removed reliably, and never written to shared directories. 4. Disable shell tracing around credential handling and avoid printing or logging the complete request URL. 5. Redact the `key` parameter in monitoring, proxy, diagnostic, and error logs. 6. Store configuration files containing API keys with owner-only permissions, such as mode `0600`, or use an operating-system secret manager. 7. Rotate any API key suspected of having appeared in process captures or logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/keepa.sh:246
• Finding: Improper URL Encoding Allows Keepa API Parameter Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/keepa.sh`, lines 246-287 **Vulnerability Type**: HTTP query-parameter injection caused by missing input validation and URL encoding **Risk Level**: Medium ### Vulnerable Code ```bash local params="&domain=$KEEPA_DOMAIN&asin=$asin&history=1&rating=1" ``` ```bash local encoded_query=$(echo "$query" | sed 's/ /+/g') local params="&domain=$KEEPA_DOMAIN&query=$encoded_query&page=$page" ``` Related unvalidated parameter construction also occurs for bestseller requests: ```bash local params="&domain=$KEEPA_DOMAIN&categoryId=$category_id&page=$page" ``` ### Technical Analysis User-controlled values are concatenated into URL query strings without standards-compliant percent encoding. The search command only replaces spaces with plus signs; it does not encode reserved characters such as `&`, `=`, `+`, `%`, `#`, or control characters. Consequently, an input containing `&name=value` can terminate the intended parameter value and introduce additional query parameters. The ASIN, page, and days-related command options also lack strict format or range validation. Shell command injection is mitigated because the assembled URL is passed to `curl` as a quoted argument. The endpoint and hostname are fixed, so this issue does not establish arbitrary command execution or SSRF. The vulnerability instead affects the semantics and integrity of requests sent to the Keepa API. The exact treatment of duplicate or unexpected parameters depends on Keepa's server-side parsing. ### Attack Path 1. An attacker supplies or convinces a user to process a crafted search term, ASIN, or option value containing URL delimiters such as `&`. 2. The script performs only space substitution for search terms and no proper encoding for the other values. 3. The crafted value is concatenated directly into `params`. 4. `keepa_request` appends the resulting string to the authenticated Keepa URL. 5. Keepa parses the injected delimiter as the ...[truncated 856 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Construct requests using curl's URL-encoding facilities instead of manually concatenating query strings. For example: ```bash curl -sS --compressed --get "https://api.keepa.com/product" \ --data-urlencode "key=${KEEPA_API_KEY}" \ --data-urlencode "domain=${KEEPA_DOMAIN}" \ --data-urlencode "asin=${asin}" \ --data-urlencode "history=1" \ --data-urlencode "rating=1" ``` Apply equivalent encoding to search, bestseller, and pagination parameters. Additional hardening should include: 1. Validate each ASIN against the exact format accepted by Keepa before making a request. 2. For batch operations, split the list and validate every ASIN independently. 3. Require `page`, `days`, domain IDs, and category IDs to be decimal integers within documented ranges. 4. Reject unknown marketplace and category names instead of silently defaulting to US or Electronics. 5. Restrict output format to an explicit allowlist such as `table` or `json`. 6. Fail with a clear error when an option is missing its required value. 7. Add tests containing reserved characters, Unicode, empty values, duplicate-parameter attempts, and malformed percent escapes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Credential Access

High

• Category: Privilege Escalation

Content

1. **Keepa API Key** (required):
   - Input your Keepa API key
   - Get key from: https://keepa.com/#!api

2. **Default marketplace**:
   - US (amazon.com)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if [[ -z "$KEEPA_API_KEY" ]]; then
        print_error "Keepa API key is not configured!"
        echo ""
        echo "Get API key from: https://keepa.com/#!api"
        echo "Then: export KEEPA_API_KEY=your_key"
        echo "Or create: ~/.teamclaw-skills/keepa-api/CONFIG.md"
        exit 1

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs use of shell capabilities (`test`, `curl`, package installation commands) but does not declare any explicit tool scope such as allowed tools or permissions. This weakens least-privilege controls and can cause the agent to execute shell actions users or platform policy did not expect.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill description and operational guidance are written in Chinese, with no indication that users may choose another language or that the locale is intentionally limited. Under the language/locale policy, a skill should not implicitly force a specific language without user opt-in or clear justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill asks the user for a Keepa API key and specifies storing it in local `CONFIG.md` files, but does not clearly warn that the credential will be persisted on disk. Users may disclose a secret without understanding its storage location, retention, or exposure risk to other local processes, repositories, or backups.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Execute curl request**:
```bash
curl -s "https://api.keepa.com/product?key=$API_KEY&domain=$DOMAIN&asin=$ASIN"
```

### Step 4: Parse and Display Results

• Confidence: 88% confidence
• Finding: The skill transmits user-supplied and secret data, including the API key and queried product identifiers, to an external service via `curl`. External transmission is expected for an API client, but it still creates data exposure risk and should be explicitly scoped and disclosed, especially because the request is performed through a generic shell command.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to place the API key in the URL query string without warning that query parameters are commonly exposed in browser history, reverse-proxy logs, analytics, crash reports, and shared shell history. Although this mirrors the vendor API design, publishing examples this way without any credential-handling warning increases the chance of accidental secret disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

Keepa API 使用 API Key 进行认证，所有请求都需要在 URL 参数中包含 `key` 参数。

```
https://api.keepa.com/product?key=YOUR_API_KEY&domain=1&asin=B08XYZ123
```

### 获取 API Key

• Confidence: 89% confidence
• Finding: This reference points to an external third-party API endpoint and the surrounding example includes credential transmission to that external service. In this skill context, external transmission is expected, but it is still security-relevant because users may unknowingly send sensitive API keys off-platform and expose them through URL-based authentication.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cURL examples send requests to a third-party service while embedding the API key directly in the command line, which can leak via shell history, process listings, CI logs, and terminal recordings. The issue is amplified because the examples normalize operational use of real credentials without warning users about exposure paths.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 查询单个 ASIN

```bash
curl -s "https://api.keepa.com/product?key=YOUR_API_KEY&domain=1&asin=B08XYZ123&history=1"
```

### 批量查询 ASIN

• Confidence: 90% confidence
• Finding: The cURL example makes an outbound request to Keepa and includes the API key in the URL, causing both external transmission and potential local credential exposure. In an API client skill this behavior is functionally necessary, but the lack of disclosure and safe-usage guidance makes it a real security concern rather than a mere false positive.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 批量查询 ASIN

```bash
curl -s "https://api.keepa.com/product?key=YOUR_API_KEY&domain=1&asin=B08XYZ123,B09ABC456,B07DEF789"
```

### 搜索产品

• Confidence: 90% confidence
• Finding: This example performs external transmission to Keepa while embedding an API key in a URL, creating the same risk of disclosure through shell history, logs, and monitoring tools. The batch-query context may also increase operational exposure because users are likely to automate these commands in scripts or CI pipelines where command logging is common.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 搜索产品

```bash
curl -s "https://api.keepa.com/search?key=YOUR_API_KEY&domain=1&query=wireless+earbuds"
```

### 获取热销榜

• Confidence: 90% confidence
• Finding: The search example transmits credentials to an external service and normalizes placing the secret in a URL. While contacting Keepa is expected for this skill, the documentation omits security context about where the key goes and how it can be captured by local or intermediary logging systems.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 获取热销榜

```bash
curl -s "https://api.keepa.com/bestsellers?key=YOUR_API_KEY&domain=1&categoryId=172282"
```

## 错误处理

• Confidence: 90% confidence
• Finding: This best-sellers example also sends an API key to a third-party endpoint via the URL, which is expected behavior for the integration but still security-significant. The danger comes less from maliciousness and more from absent warnings, making accidental credential leakage more likely in user workflows.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The help output advertises `batch-asin <ASINs>` as a multi-ASIN query command. But in the dispatcher, L384-L386 explicitly state `# For batch, just query first ASIN for now` and pass only the first comma-separated ASIN to `cmd_asin`. This directly contradicts the documented behavior of the command.

Session Persistence

Medium

• Category: Rogue Agent

Content

./keepa.sh search "wireless earbuds" --category Electronics

Configuration:
  Export KEEPA_API_KEY or create ~/.teamclaw-skills/keepa-api/CONFIG.md

Get API Key: https://keepa.com/#!api
EOF

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

keepa_request() {
    local endpoint="$1"
    local params="$2"
    local url="https://api.keepa.com/${endpoint}?key=${KEEPA_API_KEY}${params}"
    curl -s --compressed "$url"
}

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API key is embedded in the request URL, which can leak through shell history, process listings in some environments, logs, proxies, monitoring systems, or error reporting. Even over HTTPS, URL-based secrets are more likely to be recorded by infrastructure than headers or request bodies.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The natural-language comments and title in this template are written entirely in Chinese, which imposes a specific language on users without any opt-in or alternative. The policy for this category allows locale constraints only when justified or optional, neither of which is stated here.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: 文件整体以中文编写，标题也明确为“参考文档”，但未说明这是可选本地化版本或提供语言选择。按照该规则，若技能内容强制单一语言且无用户选择或明确合理化说明，可视为自然语言策略问题。

Intent-Code Divergence

Low

• Confidence: 78% confidence
• Finding: At L084, the documentation tells users to create `~/.teamclaw-skills/keepa-api/CONFIG.md`. However, `load_config` first checks `.teamclaw-skills/keepa-api/CONFIG.md` relative to the current directory, and only then checks the home-directory path. This is a documentation-to-code mismatch about where configuration is actually loaded from.

Static analysis

No suspicious patterns detected.