ClawHub
Back to skill

Security audit

Ecwid Ecommerce

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only Ecwid API reference skill that handles sensitive store and customer data but does not include hidden execution, persistence, or exfiltration behavior.

Install only if you trust the publisher with access to your Ecwid store data. Use a read-only, least-privilege Ecwid token, limit responseFields when possible, avoid exposing customer PII in logs or shared chats, and do not enable write HTTP methods unless you intentionally need store mutation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill enables access to orders, customers, and abandoned carts, which can expose personal data such as names, emails, addresses, phone numbers, billing/shipping details, and private admin notes. Although the document includes token-scope guidance, it does not prominently warn that these endpoints process sensitive customer data, increasing the risk of overcollection, accidental disclosure, or inappropriate downstream sharing.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The manifest description says the skill is for "managing" store data including multiple resource types, which commonly implies create/update/delete capabilities. However, the documented endpoints throughout the file are exclusively GET operations, and the connection guidance emphasizes GET for read-only use; no concrete write operations are actually defined.

Intent-Code Divergence

Low
Confidence
95% confidence
Finding
The text explicitly states "No CLI binaries required" and then immediately says the skill uses HTTP API via Direct API connection or curl. That is an internal contradiction in the documentation, because curl is a command-line binary.

Static analysis

No suspicious patterns detected.