Amazon Product Research & Seller Analytics

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:58 AM UTC
• Version: 1.2.1

Overview

This Amazon seller analytics skill is mostly coherent, but it needs Review because it encourages risky plaintext API-key handling and includes nationality-based seller profiling beyond ordinary product research.

Review before installing. Prefer setting `APICLAW_API_KEY` as an environment variable or secret, do not ask the agent to save it to `config.json`, and avoid sharing unnecessary business-sensitive details. Be aware that product queries are sent to APIClaw, the README's npx installer is unpinned, and the Chinese-seller workflow should be avoided or rewritten to use neutral competitor-performance criteria instead of nationality inference.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:34

Finding

Unpinned npm Package Execution in the Recommended Installation Procedure

Content

View full analysis

Remediation

View remediation

install Amazon-analysis-skill ``` 2. Document the expected npm registry and package publisher so users can verify package provenance. 3. Publish and verify package integrity information where the installation workflow supports it. 4. Prefer a lockfile-backed or otherwise reproducible installation mechanism. 5. Retain a manual installation option that downloads a versioned release archive with a published cryptographic checksum. 6. Advise users not to run installation commands with administrator or root privileges. 7. Periodically review the pinned dependency and update it only after auditing the new release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/apiclaw.py:62

Finding

Plaintext API-Key File Fallback Without Permission Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

> AI-powered Amazon product research. From market discovery to daily operations.
>
> **Language rule**: Always respond in the user's language. If the user asks in Chinese, reply in Chinese. If in English, reply in English. The language of this skill document does not affect output language.
> All API calls go through `scripts/apiclaw.py` — one script, 5 endpoints, built-in error handling.

## Credentials

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

| `SKILL.md` (this file) | Start here — covers 80% of tasks |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/apiclaw.py (reported line 64)May include surrounding context.

python

def get_api_key():
    """
    Get API key from environment variable or config file.

    Priority:
    1. Environment variable APICLAW_API_KEY

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README tells users to run npx clawhub install Amazon-analysis-skill without pinning a specific package version. This creates a supply-chain risk because users may fetch and execute whatever version is current at install time, including a compromised or malicious release, and npx execution can run package install scripts or code in the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly suggests storing the API key in a config file via the agent without warning about plaintext credential storage, file permissions, or the possibility that the config may be checked into source control. In an agent-skill context, this is more dangerous because users may not know where the key is persisted, whether other tools can read it, or whether the agent may expose it through logs or workspace files.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requests or implies access to sensitive capabilities—environment variables, file reads, and outbound network calls—but does not declare an explicit tool scope such as allowed-tools or permissions. That creates an overbroad execution surface where a host agent may grant more capability than is necessary, increasing the risk of secret exposure (for example APICLAW_API_KEY from env or config.json) and unintended file/network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases for comprehensive recommendations are broad enough that the skill may activate on generic shopping or advisory requests such as 'help me choose' or 'most suitable for me.' That can cause unintended invocation, leading the agent to gather seller/business profiling data or produce Amazon-specific guidance when the user did not clearly request this skill.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 70% confidence

Finding

The workflow explicitly tells the agent to gather multiple pieces of user-provided information, including budget, experience, and preferences, and later incorporate them into the output template. While framed as recommendation logic, this is a natural-language instruction to collect and surface user data, which creates a data-handling risk beyond simple static keyword checks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly profiles sellers by nationality/location and then applies fallback heuristics based on names, language patterns, and product categories to infer whether a seller is Chinese. This goes beyond core product research and creates a risk of sensitive attribute inference, stereotyping, and discriminatory business recommendations based on national origin rather than neutral seller performance metrics.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger includes very broad phrasing such as 'Chinese sellers,' which can invoke a workflow centered on nationality-based profiling from minimal user input. Because the underlying scenario directs identity-focused filtering and inference, accidental activation is more harmful here than in ordinary product research flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrase "can I do this" is excessively broad and can match many unrelated user requests, causing the skill to activate outside its intended Amazon product research scope. That increases the chance of inappropriate routing, unintended tool/API use, and confused or misleading responses in contexts unrelated to seller analytics.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Multiple generic trigger phrases like "what do users want" or "who is buying" are ambiguous and likely to overlap with ordinary conversation or other skills. In an agentic system, this can lead to false activations, data fetches against the wrong intent, and reduced reliability of downstream analysis.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases for competitive listing analysis are broad enough that ordinary product or marketing questions could unintentionally invoke competitor-research workflows. This can cause the agent to gather and analyze external marketplace data when the user did not explicitly request that action, increasing the chance of over-collection, surprise tool use, and incorrect task routing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The listing copy generation section uses generic triggers like 'write listing' and 'help me write product page,' which can overlap with non-Amazon copywriting requests. If auto-invoked, the skill may request competitive data and generate marketplace-specific content without clear user consent or scope validation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The optimization diagnosis triggers are ambiguous and could match general editing or content-improvement requests unrelated to Amazon listings. In that case, the agent may incorrectly pull product and competitor data, producing unintended analysis and unnecessary external API usage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The load condition says to load the skill for broad 'pricing strategy, profit estimation, or listing reference tasks,' which can match many generic commerce or pricing questions outside the intended Amazon/APICLAW context. Over-broad activation increases the chance the agent invokes this skill unnecessarily, causing unintended data access, irrelevant external API use, or leakage of user task context to the integrated tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/reference.md (reported line 21)May include surrounding context.

md

# ─── Configuration ───────────────────────────────────────────────────────────

BASE_URL = "https://api.apiclaw.io/openapi/v2"  # APIClaw API base URL
API_DOCS = "https://api.apiclaw.io/api-docs"   # API documentation URL
MAX_RETRIES = 2       # Maximum number of retry attempts for failed requests
RETRY_DELAY = 2       # Initial retry delay in seconds; doubles on 429 (rate limit)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/apiclaw.py (reported line 32)May include surrounding context.

python

# ─── Configuration ───────────────────────────────────────────────────────────

BASE_URL = "https://api.apiclaw.io/openapi/v2"  # APIClaw API base URL
API_DOCS = "https://api.apiclaw.io/api-docs"   # API documentation URL
MAX_RETRIES = 2       # Maximum number of retry attempts for failed requests
RETRY_DELAY = 2       # Initial retry delay in seconds; doubles on 429 (rate limit)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/apiclaw.py (reported line 33)May include surrounding context.

python

# ─── Configuration ───────────────────────────────────────────────────────────

BASE_URL = "https://api.apiclaw.io/openapi/v2"  # APIClaw API base URL
API_DOCS = "https://api.apiclaw.io/api-docs"   # API documentation URL
MAX_RETRIES = 2       # Maximum number of retry attempts for failed requests
RETRY_DELAY = 2       # Initial retry delay in seconds; doubles on 429 (rate limit)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The script explicitly instructs users to persist the API key in a plaintext config.json file within the skill directory. Persisting credentials in plaintext increases the chance of accidental disclosure through source control, backups, multi-user hosts, or other local file access, especially in agent/skill environments where directories may be synced or inspected.

Content

Scanner excerpt · scripts/apiclaw.py (reported line 98)May include surrounding context.

python

print("    export APICLAW_API_KEY='hms_live_yourkey'", file=sys.stderr)
    print("", file=sys.stderr)
    print("  Method 2: Config file", file=sys.stderr)
    print(f"    Create config.json in the skill directory: {skill_dir}", file=sys.stderr)
    print('    Content: {"api_key": "hms_live_yourkey"}', file=sys.stderr)
    print("", file=sys.stderr)
    print("Get a free key at https://apiclaw.io/api-keys", file=sys.stderr)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The self-check docstring says it verifies API connectivity and available endpoints, but its credential lookup behavior differs from the main documented credential mechanism. Elsewhere the script documents config.json in the skill directory as the fallback location, while cmd_check instead reads ~/.apiclaw/config.json, creating contradictory operator guidance about where the skill actually expects secrets.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger text says to load the skill when handling "market monitoring, competitor tracking, or anomaly detection," which describes broad classes of common analysis work rather than narrowly scoped activation phrases or constraints. Because it does not provide explicit boundaries, exclusions, or negative examples, the skill may be invoked in situations beyond the intended Amazon seller operations context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs outbound HTTP POST requests to a third-party service and includes both user-provided parameters and a bearer API key. Although the file has API-oriented docstrings, it does not clearly warn users that their search terms, ASINs, category data, and related inputs will be sent to an external service when commands run.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/apiclaw.py (reported line 311)May include surrounding context.

python

"priceMin", "priceMax", "ratingMin", "ratingMax", "bsrMin", "bsrMax",
                 "salesGrowthRateMin", "salesGrowthRateMax", "sellerCountMin", "sellerCountMax",
                 "variantCountMin", "variantCountMax"):
        val = getattr(args, attr.replace("Min", "_min").replace("Max", "_max")
                      .replace("monthly", "monthly_").replace("review", "review_")
                      .replace("sales", "sales_").replace("Growth", "_growth_")
                      .replace("Rate", "rate_").replace("price", "price_")

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The subparser help says the check command will 'Fetch latest OpenAPI spec to verify available endpoints', but cmd_check never fetches the OpenAPI spec or API docs. It only makes test calls against a hardcoded subset of endpoints, so the inline help actively misstates what the command does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.