ClawHub
Back to skill

Security audit

Shopee to Notion Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Shopee-to-Notion sync purpose, but it uses unsafe command/input handling and reads credentials from a fixed external workspace path.

Review before installing. Use only isolated, least-privilege Shopee and Notion credentials, fix the hardcoded .env path, validate and safely pass keyword/limit/target arguments, and add an explicit preview or confirmation before Notion writes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
jobs/shopee-client.js:17
Finding

User-Controlled GraphQL Injection in Shopee Product Search

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:15
Finding

Unsafe Shell Command Template Permits Command Injection

Content
View full analysis
" ``` ### Technical Analysis The Skill requires the Agent to place a user-controlled keyword inside a shell command enclosed by double quotes, but it does not require use of a non-shell process API or define safe argument escaping. Double quotes do not neutralize every shell construct. A malicious keyword containing a closing quote, command substitution, or shell metacharacters could escape the intended argument if the Agent invokes the command through a shell. The `limit` and `target` placeholders are likewise unsafe if populated without strict validation. This issue depends on the command-execution tool using shell parsing. It is nevertheless an exploitable instruction-level coding flaw because the mandated template encourages direct construction of a shell command from untrusted input. ### Attack Path 1. An attacker asks the Agent to search for a keyword containing shell syntax. 2. The Agent follows the mandatory Skill instruction and substitutes the keyword into the command template. 3. The command is submitted to an execution tool that invokes a shell. 4. Shell parsing treats part of the keyword as command syntax rather than as a single literal argument. 5. The injected command executes with the same operating-system permissions as the Agent process. ### Impact Assessment Successful exploitation can provide local command execution with the privileges of the Agent runtime. Depending on those privileges, an attacker could read workspace files and environment data, access integration credentials, modify project files, make outbound requests, or interfere with other tasks. The fixed external credential path in `jobs/config.js` increases the potential sensitivity of files available to the proce ...[truncated 7 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
jobs/config.js:3
Finding

Fixed External Environment File Breaks Workspace Credential Isolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
jobs/sync-shopee-notion.js:17
Finding

Sensitive Database Identifier and Excessive API Error Details Exposed in Logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

│ └── shopee-to-notion/ │ └── SKILL.md ├── package.json └── .env

text

---

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims a local-only Notion sync workflow, but the described behavior includes external network access, credentialed API use, and functionality that does not match the stated sync purpose. This mismatch can mislead users and orchestrators into approving a workflow they believe is local and low-risk while it actually performs authenticated outbound requests and data handling.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
`node jobs/sync-shopee-notion.js "<keyword>" <limit> <target>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
`node jobs/sync-shopee-notion.js "<keyword>" <limit> <target>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
`node jobs/sync-shopee-notion.js "<keyword>" <limit> <target>`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · jobs/config.js (reported line 3)May include surrounding context.

js
console.log("=== USANDO SCRIPT NODE SHOPEE->NOTION ===");

require("dotenv").config({ path: "/data/.openclaw/workspace-sales/.env" });

const targets = {
  shopee_produtos: process.env.NOTION_DATABASE_ID

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins axios to 1.14.0, and the finding cites multiple advisories including SSRF-related proxy bypass and prototype-pollution-adjacent issues. In a skill that synchronizes data between external services using HTTP requests, a vulnerable HTTP client materially increases risk because attacker-controlled endpoints, redirects, or environment-driven proxy behavior may be reachable during normal operation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
80% confidence
Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection via unescaped multipart field names and filenames. This is only exploitable if the application builds multipart requests using attacker-controlled field metadata, but because this package is present and may be used indirectly by axios, it represents a real dependency risk that could enable header/body injection in specific upload flows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

axios is flagged with multiple known advisories, including SSRF-related and prototype-pollution/MITM-related issues. In a skill that syncs Shopee data to Notion and likely performs outbound HTTP requests with credentials or tokens, a vulnerable HTTP client is especially risky because it may enable request manipulation, proxy bypass, credential leakage, or access to unintended internal resources depending on how requests are constructed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README instructs users to run a workflow that queries Shopee and writes data into Notion, but it does not clearly disclose the data-flow and side effects up front. This can mislead operators into invoking a skill that sends requests to external services and modifies persistent third-party state without an explicit warning or confirmation model.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md
- Search products on Shopee using a keyword.
- Sync results into a configured Notion database.
- Create new products or update existing ones.
- Uses a local Node.js workflow for predictable execution.
- Supports configurable targets for different Notion databases.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes code-execution capability expectations without declaring an explicit tool scope or permission boundary. In practice, this makes it harder to constrain what the skill may access at runtime and increases the chance that environment variables or other local capabilities are used implicitly without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs syncing and updating data in Notion but does not warn that it may modify external records. Users may think they are only retrieving product information, when the workflow could create or update entries in a connected workspace, creating integrity and operational risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger conditions are broad enough to activate on many ordinary shopping or product requests, which can cause the agent to invoke a side-effecting workflow too aggressively. Because the skill may perform external calls and modify records, overbroad activation increases the risk of unintended execution and data changes without clear user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes syncing Shopee products into Notion using a local Node.js workflow, which justifies using Shopee and Notion credentials but does not itself justify reading them from an arbitrary fixed filesystem path. Hard-coding access to /data/.openclaw/workspace-sales/.env adds a local file-access capability beyond the stated business purpose of syncing data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jobs/notion-client.js (reported line 48)May include surrounding context.

js
async function buscarPaginaExistentePorId(databaseId, itemId) {
  const response = await axios.post(
    `https://api.notion.com/v1/databases/${databaseId}/query`,
    {
      filter: {
        property: "id",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jobs/notion-client.js (reported line 75)May include surrounding context.

js
async function buscarPaginaExistentePorId(databaseId, itemId) {
  const response = await axios.post(
    `https://api.notion.com/v1/databases/${databaseId}/query`,
    {
      filter: {
        property: "id",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jobs/notion-client.js (reported line 87)May include surrounding context.

js
async function buscarPaginaExistentePorId(databaseId, itemId) {
  const response = await axios.post(
    `https://api.notion.com/v1/databases/${databaseId}/query`,
    {
      filter: {
        property: "id",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code creates and updates pages in a Notion database via HTTP calls, which modifies user-controlled remote data. There is no visible confirmation prompt, logging, comment, or docstring in this file disclosing that product data will be written to Notion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code transmits the user-provided keyword to an external Shopee API and includes an Authorization header derived from application credentials. There is no confirmation prompt, logging, comment, or other visible disclosure in this file warning that user input and authenticated requests are sent to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The mandated response fields include Portuguese-only labels such as "keyword usada," "criados," and "falhas," which effectively impose a specific language. There is no opt-in, user language selection, or documented justification for restricting output to Portuguese.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
83% confidence
Finding

follow-redirects is a transitive dependency of axios and the cited issue involves leaking custom authentication headers across cross-domain redirects. This is relevant here because the skill likely uses API tokens for Shopee and Notion; if a request follows a malicious or unexpected redirect, sensitive authorization headers could be exposed to another host.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^1.14.0) rather than an exact version pin, which allows different installs to resolve to different package versions over time. This weakens build reproducibility and can unexpectedly introduce a compromised or vulnerable release through normal dependency resolution.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"license": "ISC",
  "description": "",
  "dependencies": {
    "axios": "^1.14.0",
    "dotenv": "^17.4.1"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dotenv dependency is also specified with a caret range, so installations are not fully deterministic and may pull newer transitive code than originally reviewed. While this is a supply-chain hygiene issue rather than an immediate exploit by itself, it increases exposure to accidental or malicious upstream changes.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"description": "",
  "dependencies": {
    "axios": "^1.14.0",
    "dotenv": "^17.4.1"
  }
}

Static analysis

No suspicious patterns detected.