ClawHub
Back to skill

Security audit

Ebay Item Detail

Security checks across malware telemetry and agentic risk

Overview

This eBay extraction skill mostly reads public listing data, but it also gives under-scoped guidance for high-throughput scraping and rate-limit avoidance.

Install only if you intend to extract eBay listing details and are comfortable with scraping-oriented workflows. Avoid using the stealth multi-session batching guidance unless you have clear authorization and are respecting eBay's rules; prefer single-item or small, user-directed runs, and confirm before writing collected item data to disk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill goes beyond single-item extraction and explicitly provides operational guidance for serial batching, throttling evasion, and running multiple stealth browser sessions in parallel. That materially expands the capability from user-assistive page reading into scalable scraping behavior, increasing abuse potential and making the skill more useful for high-volume data harvesting against a third-party site.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation description is broad enough to trigger the skill for monitoring, competitive research, catalog audits, and general enrichment tasks beyond a narrowly scoped 'extract details from the currently open item page' action. Overbroad activation criteria increase the chance the agent invokes the skill in contexts involving sustained scraping or collection workflows that the user did not explicitly authorize at execution time.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs writing per-item JSON results to local storage without clearly surfacing that behavior as a side effect to the user. Silent persistence can create data handling and consent problems, especially when outputs may contain seller identifiers, locations, pricing snapshots, and other collected marketplace data that users may assume is returned transiently rather than stored on disk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.