ClawHub
Back to skill

Security audit

亚马逊差评分析 · 负面评论根因拆解

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it needs Review because a narrowly labeled bad-review analyzer also includes broader account-changing, recurring monitoring, export, and paid-workflow authority.

Install only if you intend to connect an ARI account and let the agent use it for Amazon review operations. Before allowing writes, confirm the exact ASIN, cost, report/export destination, and whether any schedule, competitor binding, or watch will keep running after the current task. Treat this as an account-management skill, not just a one-off review summarizer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Tainted flow: 'req' from os.environ.get (line 1349, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()
Confidence
83% confidence
Finding
The export path writes arbitrary server responses to a caller-supplied local path via --out after fetching authenticated content. While this is a user-invoked CLI feature rather than silent malware behavior, it can overwrite sensitive local files if the skill/agent passes an unsafe path, and it expands the skill from analysis into filesystem modification.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to use shell, network, environment-variable, and local file write capabilities to configure API keys, run commands, and persist credentials, but it does not declare those permissions up front. That creates a transparency and consent gap: a host or user may invoke the skill expecting review analysis while the skill can also execute local commands and modify local state.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The advertised purpose is narrowly framed as bad-review analysis, but the documentation exposes a much broader operational surface: account setup, billing-sensitive paid actions, monitoring creation, competitor management, exports, archived report access, and workflow execution. This mismatch can cause users or orchestrators to grant trust and invoke the skill under a narrower expectation than its actual authority, increasing the risk of unintended paid actions, data access, and account changes.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The file implements broad watch/monitoring, product-operations, competitor management, benchmarking, leaderboard, workbench, advice, and export workflows that go well beyond the stated bad-review analysis purpose. This scope mismatch is dangerous in an agent setting because users and orchestrators may grant trust and credentials based on a narrow manifest, while the code can perform materially broader account actions.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code can change remote account state by submitting collections, modifying schedules, adding/removing competitors, creating/updating/deleting watches, marking alerts read, updating review workflow status, and running paid operations. For a skill presented as negative-review analysis, these mutating capabilities create a significant risk of unintended charges, persistent monitoring changes, and account-side workflow alterations if an agent invokes them under ambiguous user intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are broad enough to match common, ambiguous user requests, which raises the chance that this skill is auto-invoked when the user did not intend to authorize an external API workflow. In this skill's context, unintended invocation is more dangerous because it can lead to account checks, pricing/credit interactions, external data collection flows, and other actions beyond simple local text analysis.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.