ClawHub
Back to skill

Security audit

walmart-research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about using Crawlora for Walmart research, but its helper can send broader authenticated API requests than the documented read-only Walmart endpoints require.

Install only if you are comfortable giving the skill a Crawlora API key and letting it send Walmart research requests to Crawlora. Review or tighten the helper before use if you need strict read-only behavior, especially by limiting it to the documented GET routes and numeric item IDs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crawlora.sh:43
Finding
Overbroad Authenticated API Method and Route Allowlist<![CDATA[ ## Vulnerability Details **File Location**: `scripts/crawlora.sh`, lines 43-68 **Vulnerability Type**: Insufficient validation of authenticated API requests **Risk Level**: Medium ### Vulnerable Code ```sh # This skill's helper is limited to its documented Crawlora route set. Keep # caller-account surfaces and unrelated API routes out of the helper even if # someone supplies an undocumented path directly. case "$method" in GET|POST) ;; *) echo "only GET and POST are supported by the walmart-research skill" >&2 exit 2 ;; esac # Reject path syntax that could smuggle a route through a shell glob check. case "$path" in ""|*[?#%]*|*..*|*//* ) echo "invalid path for the walmart-research skill" >&2 exit 2 ;; esac case "$path" in /walmart/product/*) ;; /walmart/product/*/reviews) ;; /walmart/search) ;; *) echo "path is not in the walmart-research skill catalog" >&2 exit 2 ;; esac ``` ### Technical Analysis The documented API contract contains only three `GET` endpoints: - `/walmart/search` - `/walmart/product/{item_id}` - `/walmart/product/{item_id}/reviews` The helper nevertheless permits both `GET` and `POST` for all accepted paths. It also uses the shell glob `/walmart/product/*` as a route allowlist. In shell pattern matching, `*` can match slash characters, so this rule accepts arbitrary nested paths such as `/walmart/product/123/undocumented`. Because this broad rule appears before the reviews-specific rule, it also matches review paths without enforcing their exact structure. The helper does not require `item_id` to be numeric, despite the Skill documentation identifying it as the numeric component of a Walmart product URL. Consequently, the validation does not enforce the minimum method and route privileges needed for the three declared operations. Requests remain restricted to the fixed HTTPS origin `https://api.crawlora.net/api/v1`, so this flaw does not allow redirecting the API key to an a ...[truncated 1497 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Permit only the HTTP method required by the documented contract: ```sh [ "$method" = "GET" ] || { echo "only GET is supported by the walmart-research skill" >&2 exit 2 } ``` 2. Replace broad shell globs with exact, anchored route validation. Require product IDs to contain digits only: ```sh case "$path" in /walmart/search) ;; /walmart/product/[0-9]*) item_id="${path#/walmart/product/}" case "$item_id" in *[!0-9]*|"") exit 2 ;; esac ;; /walmart/product/[0-9]*/reviews) item_id="${path#/walmart/product/}" item_id="${item_id%/reviews}" case "$item_id" in *[!0-9]*|"") exit 2 ;; esac ;; *) echo "path is not in the walmart-research skill catalog" >&2 exit 2 ;; esac ``` 3. Prefer constructing paths from a small set of named operations and validated parameters rather than accepting a caller-provided path. 4. Add negative tests covering `POST`, empty IDs, nonnumeric IDs, extra path segments, encoded separators, query fragments, and undocumented nested routes. 5. Preserve the existing security controls that fix the HTTPS API origin, avoid redirects, reject curl file-input syntax, and keep the API key out of command-line arguments. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill explicitly instructs use of a shell helper script but does not declare any tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege enforcement and can cause an agent runtime to expose shell execution more broadly than users or reviewers expect, increasing the blast radius if the skill is later modified or combined with untrusted input.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash
# Crawlora REST helper — minimal, dependency-free (curl only).
# Calls https://api.crawlora.net/api/v1 with your Crawlora API key.
# Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills.
#
# Usage:
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
[ -n "$body" ] || body='{}'
  # Stream the body on stdin so curl never interprets a user value as its
  # @file shorthand (and cannot read local files supplied in a request body).
  printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" --data-binary @- "${base}${path}"
fi
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low
Confidence
76% confidence
Finding
This markdown file says to call the endpoints via `scripts/crawlora.sh` but does not define any specific activation phrases, context limits, or exclusion conditions. In a skill documentation context, that absence can make invocation boundaries unclear and increase the risk of unintended use.

Static analysis

No suspicious patterns detected.