ClawHub
Back to skill

Security audit

Amazon Product Details by Gecho

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Amazon product-detail integration that relies on Gecho's MCP server and Chrome extension, with no artifact evidence of hidden extraction, destructive behavior, or prompt leakage.

Before installing, understand that this skill depends on Gecho's MCP server and Chrome extension and will operate through a logged-in browser session. Use it only if you are comfortable with that integration accessing Amazon product pages available in your Chrome session.

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).

## Output guidelines

For success:
- Say the tool completed.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Static analysis

No suspicious patterns detected.