ClawHub
Back to skill

Security audit

ebay-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about using Crawlora for eBay research, but its authenticated helper accepts broader Crawlora eBay paths and HTTP method combinations than the documented catalog.

Review before installing if you care about strict API scoping. Use a Crawlora key with limited credits, invoke only the documented eBay endpoints, and prefer a hardened helper that binds each endpoint to its exact allowed HTTP method and rejects extra path segments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/crawlora.sh:42
Finding
Overly Broad Route and HTTP Method Authorization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh:42-75` **Vulnerability Type**: Insufficient route and HTTP method authorization **Risk Level**: Medium ### Vulnerable Code ```bash # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the ebay-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the ebay-research skill" >&2 exit 2 ;; esac case "$path" in /ebay/item/*) ;; /ebay/live/streams) ;; /ebay/live/streams/*) ;; /ebay/live/streams/*/items) ;; /ebay/live/streams/batch) ;; /ebay/search) ;; /ebay/seller/*) ;; /ebay/seller/*/about) ;; /ebay/seller/*/feedback) ;; /ebay/seller/*/shop) ;; *) echo "path is not in the ebay-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis The helper intends to limit authenticated requests to the documented eBay research API catalog. However, HTTP method validation and route validation are performed independently. The method check permits both `GET` and `POST` for every accepted path, although the documented catalog only permits `POST` for `/ebay/search` and `GET` for the other endpoints. Consequently, unsupported method and route combinations are accepted by the client. The shell wildcard patterns are also broader than the documented route shapes. In shell `case` patterns, `*` can match `/` characters. Therefore: - `/ebay/item/*` accepts arbitrary nested descendants after `/ebay/item/`. - `/ebay/seller/*` accepts every path beginning with `/ebay/seller/`, including undocumented descendants. - `/ebay/live/streams/*` accepts arbitrary nested live-stream routes and makes more speci ...[truncated 1797 chars]
Remediation
<![CDATA[ ## Remediation Suggestions Bind each documented route to its permitted HTTP method instead of validating methods and paths independently. 1. Permit only these combinations: - `POST /ebay/search` - `GET /ebay/item/{item_id}` - `GET /ebay/live/streams` - `GET /ebay/live/streams/{id}` - `GET /ebay/live/streams/{id}/items` - `GET /ebay/live/streams/batch` - `GET /ebay/seller/{seller}` - `GET /ebay/seller/{seller}/about` - `GET /ebay/seller/{seller}/feedback` - `GET /ebay/seller/{seller}/shop` 2. Require identifiers to be exactly one URL-safe path segment. Do not allow `/` inside item IDs, stream IDs, or seller names. 3. Validate the combined `"$method $path"` value. For example, use anchored Bash regular expressions for parameterized routes and exact string comparisons for static routes. 4. Reject all undocumented descendants and unsupported method combinations before creating or using the authentication configuration. 5. Add negative tests covering: - `POST` against every GET-only endpoint. - `GET /ebay/search`. - Additional suffixes such as `/ebay/seller/name/extra`. - Nested identifiers such as `/ebay/item/id/extra`. - Empty identifiers. - Routes resembling documented routes but containing extra path segments. A hardened validation structure could follow this pattern: ```bash allowed=false if [[ "$method" == "POST" && "$path" == "/ebay/search" ]]; then allowed=true elif [[ "$method" == "GET" ]]; then case "$path" in /ebay/live/streams|/ebay/live/streams/batch) allowed=true ;; esac if [[ "$path" =~ ^/ebay/item/[A-Za-z0-9._-]+$ ]] || [[ "$path" =~ ^/ebay/live/streams/[A-Za-z0-9._-]+$ ]] || [[ "$path" =~ ^/ebay/live/streams/[A-Za-z0-9._-]+/items$ ]] || [[ "$path" =~ ^/ebay/seller/[A-Za-z0-9._-]+$ ]] || [[ "$path" =~ ^/ebay/seller/[A-Za-z0-9._-]+/(about|feedback|shop)$ ]]; then allowed=true fi fi if [[ "$allowed" != true ]]; then echo "unsupported meth ...[truncated 162 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents use of a shell helper (`scripts/crawlora.sh`) but does not declare any tool restrictions such as `allowed-tools` or permissions. That creates an unnecessary trust gap: an agent may invoke broader shell capabilities than required, increasing the blast radius if prompt injection, argument manipulation, or future edits introduce unsafe commands.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
77% confidence
Finding
This code sends user-supplied request data to https://api.crawlora.net and includes the user's API key in an HTTP header. Although the behavior is evident from code comments, there is no runtime confirmation or explicit user-facing warning at the point of transmission about sending data to an external network service.

Static analysis

No suspicious patterns detected.