ClawHub
Back to skill

Security audit

亚马逊竞品评论分析 · 对手短板拆解

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed ARI Amazon review-analysis client that stores an API key locally and performs user-directed review, export, paid analysis, and monitoring actions without evidence of hidden exfiltration or destructive behavior.

Install only if you trust ARI with your Amazon review and product-operations data. Keep the ARI API key private, avoid setting ARI_ALLOW_CUSTOM_BASE unless you control the destination, and review recurring schedule/watch or competitor-binding actions because they can create ongoing server-side monitoring or collection costs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'req' from os.environ.get (line 1349, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers = {"Authorization": "Bearer " + require_key(), "User-Agent": user_agent()}
    try:
        req = urllib.request.Request(url, headers=headers, method="GET")
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            ctype = resp.headers.get("Content-Type", "")
            body = resp.read()
Confidence
80% confidence
Finding
The export/download path sends the Bearer API key to whatever host base_url() resolves to, and base_url() can be redirected through environment variables when ARI_ALLOW_CUSTOM_BASE=1 is set. Although this is an intentional development override, it still creates a real credential-exfiltration risk in compromised shells, CI environments, or wrapper processes because authenticated export requests may be silently sent to attacker-controlled infrastructure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill is presented as a competitor review analyzer, but the documented behavior spans many additional capabilities including credential setup, account checks, monitoring management, paid operations, exports, and product/watch administration. This broader-than-advertised scope can mislead users and increase the chance of unintended sensitive actions or billable operations being performed under a narrower trust assumption.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The file implements broad product-operations and review-workbench capabilities beyond the declared competitor-review scope. In an agent setting, this scope expansion is security-relevant because it exposes additional paid actions and data-processing workflows that callers may invoke without understanding they are outside the advertised contract.

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
Undisclosed watch/event monitoring and digest functions extend the skill from ad hoc competitor analysis into ongoing surveillance-style monitoring. Hidden capabilities increase risk in agent environments because they create persistence and additional data access patterns not evident from the skill description.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
Benchmark, leaderboard, alerts, export, and workbench operations materially expand functionality beyond competitor review analysis. In a tool-integrated agent context, such hidden breadth can lead to unauthorized file writes, unexpected paid queries, and access to operational workflows that users did not intend to grant.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.