ClawHub
Back to skill

Security audit

resale-secondhand-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent marketplace research helper, but it needs review because its API helper is broader than the main description and allows POST and nested routes beyond the documented read-only catalog.

Install only if you are comfortable giving the helper a Crawlora API key and allowing it to make authenticated requests to Crawlora. Review or tighten the route and method checks before using it in automated workflows, especially if untrusted prompts can choose helper arguments.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawlora.sh:44
Finding
Overbroad Route Patterns and Unrestricted POST Requests Bypass the Intended API Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 44–119 **Vulnerability Type**: Incomplete endpoint and HTTP-method allowlisting **Risk Level**: Medium ### Vulnerable Code ```bash case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the resale-secondhand-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the resale-secondhand-research skill" >&2 exit 2 ;; esac case "$path" in /depop/brands) ;; /depop/categories) ;; /depop/item/*) ;; /depop/item/*/similar) ;; /depop/search) ;; /depop/search-sellers) ;; /depop/search/facets) ;; /depop/shop/*) ;; /depop/sizes) ;; /depop/suggest) ;; /etsy/listing/*) ;; /etsy/listing/*/reviews) ;; /etsy/search) ;; /etsy/shop/*) ;; /etsy/shop/*/listings) ;; /etsy/shop/*/reviews) ;; /etsy/shop/search) ;; /goat/collection) ;; /goat/countries) ;; /goat/curated) ;; /goat/listings/count) ;; /goat/product/*) ;; /goat/product/*/recommended) ;; /goat/search) ;; /goat/search/facets) ;; /goat/searches/trending) ;; /goat/suggest) ;; /leboncoin/listing) ;; /leboncoin/search) ;; /mercari/autocomplete) ;; /mercari/home) ;; /mercari/item/*) ;; /mercari/master) ;; /mercari/search) ;; /poshmark/brand/*) ;; /poshmark/brands) ;; /poshmark/categories) ;; /poshmark/category/*) ;; /poshmark/closet/*) ;; /poshmark/listing/*) ;; /poshmark/search) ;; /poshmark/trend/*) ;; /stockx/brands) ;; /stockx/categories) ;; /stockx/product/*) ;; /stockx/releases) ;; /stockx/search) ;; /vinted/brand) ;; /vinted/brands) ;; /vinted/catalog) ;; /vinted/categories) ;; /vinted/category) ;; /vinted/item) ;; /vinted/member) ;; /whatnot/browse) ;; /whatnot/categories) ;; /whatnot/live/*) ;; *) echo "path is not in the resale-secondhand-research skill c ...[truncated 3026 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace wildcard route authorization with exact, anchored validation for each parameterized endpoint. Each path parameter should explicitly prohibit `/`. For example: ```bash if [[ "$path" =~ ^/etsy/shop/[^/]+$ ]]; then : elif [[ "$path" =~ ^/etsy/shop/[^/]+/(listings|reviews)$ ]]; then : else echo "path is not in the skill catalog" >&2 exit 2 fi ``` 2. Bind permitted methods to exact routes instead of validating the method independently. If all documented endpoints are read-only, reject every method except `GET`: ```bash [ "$method" = "GET" ] || { echo "only GET is supported for documented endpoints" >&2 exit 2 } ``` 3. If POST endpoints are added later, define an explicit route-to-method mapping and permit POST only for those exact routes. 4. Validate parameter formats where known, such as numeric listing IDs, constrained usernames, country codes, or documented slugs. This reduces ambiguity and prevents nested-route matching. 5. Add regression tests confirming rejection of: - Extra path segments such as `/etsy/shop/example/admin` - Incorrect methods such as `POST /etsy/search` - Encoded or malformed separators - Empty path parameters - Valid prefixes followed by undocumented suffixes 6. Generate the route validator from the same endpoint metadata used to generate `reference/endpoints.md`, reducing the risk of documentation and enforcement diverging. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
A description-behavior mismatch is security-relevant here because the skill is presented as limited to seven named marketplaces, while the underlying helper apparently permits additional Crawlora routes such as `/goat/*` and `/leboncoin/*`. This weakens user and policy expectations, making it easier to access undeclared third-party data sources and turning a narrowly described skill into a more generic API proxy than advertised.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documents shell-based execution (`scripts/crawlora.sh ...`) but does not declare any `permissions` or `allowed-tools` scope. That creates an authorization gap: an agent may be allowed to invoke shell broadly rather than being constrained to the minimum required capability, increasing the risk of unintended command execution or misuse beyond the stated research purpose.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown file documents that all endpoint calls require the header `x-api-key: $CRAWLORA_API_KEY`, which involves use of a sensitive credential. The file does not include any warning or handling guidance about protecting the key, avoiding logging/exposing it, or ensuring users understand that authenticated third-party API access is required.

Description-Behavior Mismatch

Low
Confidence
89% confidence
Finding
The manifest describes the skill as researching Poshmark, Etsy, Vinted, StockX, Mercari, Depop, and Whatnot, but the allowed route catalog also includes GOAT and Leboncoin endpoints. This is a semantic mismatch between the declared marketplace scope and the actual code-exposed functionality, even though the overall behavior remains resale-market research.

Static analysis

No suspicious patterns detected.