ClawHub
Back to skill

Security audit

Sellersprite Api

Security checks for vulnerabilities and agentic risk

Overview

The skill’s SellerSprite research purpose is coherent, but it runs an unpinned external CLI with access to a SellerSprite API key.

Install only if you are comfortable letting an external SellerSprite CLI receive your SellerSprite API key and product research queries. Prefer a pinned, reviewed CLI version, expose only the SellerSprite key in the runtime environment, avoid storing the key in project files, and rotate the key if you suspect the dependency or local config was exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party CLI Executes with Access to an API Secret

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-17 and 29-41
Vulnerability Type: Unpinned runtime dependency and supply-chain exposure
Risk Level: Medium

Vulnerable code:

yaml
env:
  - name: SELLERSPRITE_SECRET_KEY
    description: "SellerSprite Open API secret key (get at https://open.sellersprite.com)"
    required: false
    note: "Can also be set via: bunx @teamclaw/sellersprite-cli config set secretKey <key>"
packages:
  - "@teamclaw/sellersprite-cli"
bash
# Set API key
export SELLERSPRITE_SECRET_KEY="your-secret-key"

# Browse top categories
bunx @teamclaw/sellersprite-cli market

# Research products by keyword
bunx @teamclaw/sellersprite-cli product --keyword "wireless earbuds"

# Get ASIN details
bunx @teamclaw/sellersprite-cli asin --asin B08N5WRWNW

# Check remaining quota
bunx @teamclaw/sellersprite-cli quota

Technical Analysis

The Skill directs the agent to execute @teamclaw/sellersprite-cli through bunx without specifying an exact package version or integrity value. The repository contains neither that package's executable source nor a dependency lockfile. Consequently, the reviewed Skill does not establish which package release will execute or allow its behavior to be verified.

The executed package is expected to have access to SELLERSPRITE_SECRET_KEY. The documentation in references/api-endpoints.md, line 5, also states that the key is transmitted in a secret-key HTTP header. Sending this credential to the legitimate SellerSprite API is necessary for the declared functionality. However, because the CLI implementation and concrete API base URL are absent, the audit cannot verify the destination, TLS handling, credential storage behavior, or whether the process accesses additional environment variables and files.

This is a supply-chain vulnerability rather than evidence that the currently published dependency is malicious. A ...[truncated 1407 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @teamclaw/sellersprite-cli to an exact, reviewed version rather than resolving the latest release.
  2. Commit a lockfile that records transitive dependency versions and package integrity hashes, and require immutable/frozen-lockfile installation.
  3. Vendor the CLI implementation into the audited package or otherwise include its source so its network destinations, secret handling, and filesystem behavior can be reviewed.
  4. Verify package provenance and signatures in CI, monitor ownership and release changes, and run dependency vulnerability scanning.
  5. Execute the CLI in a restricted environment with only SELLERSPRITE_SECRET_KEY exposed; remove unrelated credentials and sensitive environment variables.
  6. Restrict outbound traffic to the documented SellerSprite API over HTTPS and explicitly document the expected API hostname.
  7. Store credentials using restrictive filesystem permissions or an operating-system secret manager. Never print the key in logs, command output, or error messages.
  8. Use a narrowly scoped, revocable API key and rotate it immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description includes many broad trigger phrases such as 'market analysis', 'keyword research', and 'product research', which can cause the skill to be invoked in situations broader than the user may intend. While not directly enabling code execution or data theft, over-broad triggering increases the chance that user queries and downstream API calls are routed to this external service unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The quick-start and usage text instructs users to send keywords and ASIN queries to the SellerSprite API, but it does not prominently warn that query data leaves the local environment and that use requires a secret key. This can lead users to unknowingly disclose commercially sensitive research terms or misuse credentials when invoking the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file describes an operation involving a sensitive credential (secret-key header) but provides no caution about protecting the API key, avoiding accidental logging, or storing it securely. Under the markdown-file warning criterion, credentials-related behavior should be disclosed when it could affect user privacy or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented warning example includes Chinese strings like "未授权" and module labels in Chinese alongside English text. Because this markdown does not state that output language is user-selectable or region-specific, it suggests the skill may surface a fixed locale in user-facing messages, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.