ClawHub
Back to skill

Security audit

Amazon Bad Review Analysis

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Amazon review-analysis client, but it needs review because an environment variable can redirect authenticated API traffic containing the saved ARI API key.

Install only if you trust ARI/funewa with the ASINs, reviews, reports, account metadata, and API key involved. Before use, ensure ARI_BASE_URL is unset unless you intentionally point it at a trusted ARI development server, and be careful with --mark-read, --set-status, exports, and any --confirm command because they can change remote workflow state or spend credits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tainted flow: 'req' from os.environ.get (line 969, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            raw = resp.read().decode("utf-8")
            out = json.loads(raw) if raw else {"success": True, "data": None}
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:

Tainted flow: 'req' from os.environ.get (line 969, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
try:
        req = urllib.request.Request(
            url, data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            content_type = resp.headers.get("Content-Type", "")
            if "text/event-stream" not in content_type:
Confidence
96% confidence
Finding
with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:

Tainted flow: 'req' from os.environ.get (line 969, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()
Confidence
95% confidence
Finding
with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as narrowly scoped negative-review analysis, but the instructions authorize a much broader operational surface: account setup, billing checks, alerts, exports, archived report access, category ranking, workbench actions, and other paid analysis modes. That mismatch can mislead users and host systems into granting broader trust than intended, increasing the chance of unauthorized data access, unintended charges, or actions outside the user's expectation.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill can modify remote state by marking alerts as read and updating review workflow status, capabilities not justified by the stated analysis-only purpose. In an agent setting, these side effects can be triggered unexpectedly and alter business records or operational workflows without clear user intent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.