Browser e-Commerce
Analysis
This instruction-only shopping workflow is coherent and bounded, though it may intentionally use your logged-in browser profile and local screenshots for private shopping pages.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
When the page is highly dynamic, check `requests`, `errors`, and `response body`.
The workflow permits browser automation to inspect network responses and page internals, which can reveal detailed commerce data. This is purpose-aligned for dynamic shopping pages and is not hidden.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
`user`: use only when existing login state matters, such as carts, coupons, orders, addresses, or member prices.
The skill explicitly allows use of the user's logged-in browser profile for private commerce pages. This is sensitive account access, but it is disclosed and aligned with shopping/cart/order tasks.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
"evidence": { "screenshot": "/tmp/...png" }The output schema includes screenshot evidence stored as a local file. If used on logged-in cart/order pages, screenshots may contain private shopping or account information.