ClawHub
Back to skill

Security audit

Amazon Products By Category API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow JustOneAPI wrapper for reading Amazon category product data, with a real but disclosed token-handling caution.

Install only if you trust JustOneAPI and are comfortable using a JustOneAPI token for this read-only product lookup. Use a limited, rotatable token where possible, avoid pasting token values into chat or logs, and be aware that this API places the token in the request URL, which may be captured by server, proxy, or process logging.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill accepts the API token via a CLI argument and then injects it into the `token` query parameter, causing the credential to be placed in the URL. Query-string secrets are commonly exposed through shell history, process listings, logs, proxies, analytics, and upstream server access logs, so the token can be disclosed even when HTTPS is used. In this skill context, the risk is real because the code is specifically designed to send a reusable authentication credential to a third-party API endpoint on every request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The API requires an authentication token to be sent in the URL query string, which is routinely captured in logs, proxies, browser history, analytics, and monitoring systems. Even over HTTPS, query parameters are more broadly exposed than headers, so this increases the chance of credential leakage and unauthorized reuse of the token.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Documenting the authentication token as a query parameter is a real security weakness because query strings are commonly captured in browser history, proxy logs, server access logs, monitoring tools, and referrer headers. In an API skill context, this increases the chance that a reusable credential is unintentionally exposed to third parties or internal systems that do not need access to it.

Static analysis

No suspicious patterns detected.