ClawHub
Back to skill

Security audit

Amazon Listing Factory

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its Amazon listing and optional image-generation purpose, but it also has under-disclosed credential, logging, recipient-discovery, and outbound messaging behavior that users should review carefully.

Install only if you are comfortable with product details, prompts, image URLs, and configured API credentials being sent to external model/image services, and review the Feishu recipient-routing behavior before enabling image generation. Use tightly scoped keys, avoid shared or writable skill directories, do not put untrusted content in .env, and rotate any image workflow key if this version has already run with logging enabled.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
run.sh:7
Finding

Arbitrary Code Execution Through Shell-Sourced Credential File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
modules/coze_generate_image.py:34
Finding

Image Workflow Credential and User Metadata Persisted in Plaintext Logs

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
modules/coze_generate_image.py:134
Finding

OpenClaw Terminal Pane Scraping to Discover Feishu User and Chat Identifiers

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skill.py:213
Finding

API Credentials and User Data Can Be Sent to Unrestricted Configurable Endpoints

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (36)

Tainted flow: 'req' from os.environ.get (line 370, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The destination URL and bearer token are environment-controlled, and user prompt data is transmitted to that endpoint without in-code trust restrictions. If the environment is misconfigured or attacker-controlled, prompts and workflow data can be exfiltrated to an arbitrary external service along with sensitive credentials or metadata.

Content

Scanner excerpt · modules/coze_generate_image.py (reported line 380)May include surrounding context.

python
}
    )

    with urllib.request.urlopen(req, timeout=120) as resp:
        return json.loads(resp.read().decode("utf-8"))

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · HOW_TO_USE.md (reported line 25)May include surrounding context.

md
bash ~/.openclaw/workspace/skills/amazon-listing-factory/run.sh "生成listing：充电宝，美国站，突出便携、大容量、安全感，输出6张图"

如需自动生图，请先配置 .env 中的图片环境变量，并前往米核获取 KEY：
miheai.com/s/98707

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documented purpose is Amazon listing generation, but the observed behavior includes external API calls, image generation, recipient identification via environment/tmux inspection, outbound delivery to Feishu, and runtime logging. This hidden functionality creates a serious trust boundary violation: users may provide commercial content or sensitive data for copywriting while the skill silently performs networked side effects and user-context discovery unrelated to the stated task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code enumerates many environment variables and even inspects tmux session output to infer current messaging recipients and chat context. For an Amazon listing draft skill, this is unjustified access to operational/user metadata and enables unintended message targeting, privacy violations, and cross-context data leakage.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill does more than generate listing-related content: it auto-routes generated images and sends them to Feishu recipients. This hidden messaging capability is outside the declared skill purpose, making data exfiltration and unauthorized outbound communication much more dangerous because users and operators would not expect it.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 7)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 14)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 15)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 29)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The script sources $SKILL_DIR/.env directly into the shell, which executes any shell syntax contained in that file, not just key-value assignments. If an attacker can modify the .env file or influence its contents, this becomes arbitrary code execution in the context of whoever runs the skill; in a skill environment that may also expose secrets as exported variables to child processes.

Content

Scanner excerpt · run.sh (reported line 10)May include surrounding context.

sh
if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"
  set +a
fi

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill automatically creates and reads a plaintext .env file in the skill directory for API keys and tokens, encouraging long-lived credential storage alongside code. In shared or weakly permissioned environments, those secrets can be exposed through filesystem access, backups, packaging, or accidental publication, and this skill uses multiple external-service credentials that could enable unauthorized API use.

Content

Scanner excerpt · skill.py (reported line 165)May include surrounding context.

python
def ensure_env_file():
    skill_dir = Path(__file__).resolve().parent
    env_file = skill_dir / ".env"
    env_template = skill_dir / "ENV_TEMPLATE.txt"
    if env_file.exists():
        return env_file

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing instructions entirely in Chinese, including the recommended slash command usage and local test examples. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains user-facing operational instructions entirely in Chinese, including the recommended invocation example. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can exclude users and conflicts with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README content and invocation examples are entirely in Chinese, including the prescribed slash command input, with no indication that other languages are supported or that Chinese is a required locale for a justified reason. This can violate language/locale policy when a skill implicitly mandates one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README states that the skill may automatically generate images if an image environment is configured, but it does not disclose whether this uses external models or APIs, what data is transmitted, or whether charges may be incurred. In a content-generation skill, this can lead to unexpected data exposure and unanticipated cost-bearing actions by users who believe they are only generating text drafts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises no explicit tool restrictions even though it appears capable of using shell, filesystem, environment inspection, and network access. In an agent setting, missing scope declarations weakens least-privilege controls and can allow broader-than-expected actions if the skill is invoked with sensitive context or elevated runtime permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructional content and invocation examples from L18 onward are written only in Chinese, including the recommended command usage. This imposes a language expectation without opt-in or explanation that the skill is region-specific, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ENV_TEMPLATE.txt (reported line 9)May include surrounding context.

text
WORKFLOW_ID = os.environ.get("COZE_WORKFLOW_ID", "").strip()
COZE_TOKEN = os.environ.get("COZE_TOKEN", "").strip()
COZE_API_URL = os.environ.get("COZE_API_URL", "https://api.coze.cn/v1/workflow/run").strip()

DEFAULT_RATIO = "1:1"
DEFAULT_RESOLUTION = "1K"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · modules/coze_generate_image.py (reported line 16)May include surrounding context.

python
WORKFLOW_ID = os.environ.get("COZE_WORKFLOW_ID", "").strip()
COZE_TOKEN = os.environ.get("COZE_TOKEN", "").strip()
COZE_API_URL = os.environ.get("COZE_API_URL", "https://api.coze.cn/v1/workflow/run").strip()

DEFAULT_RATIO = "1:1"
DEFAULT_RESOLUTION = "1K"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.py (reported line 178)May include surrounding context.

python
WORKFLOW_ID = os.environ.get("COZE_WORKFLOW_ID", "").strip()
COZE_TOKEN = os.environ.get("COZE_TOKEN", "").strip()
COZE_API_URL = os.environ.get("COZE_API_URL", "https://api.coze.cn/v1/workflow/run").strip()

DEFAULT_RATIO = "1:1"
DEFAULT_RESOLUTION = "1K"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

The code captures content from a live tmux pane to infer who most recently sent a message, effectively scraping unrelated runtime/session data to obtain recipient identifiers. In this skill context, that behavior exceeds the stated Amazon listing draft purpose and can leak or misuse chat metadata from another process, creating a privacy and unauthorized-routing risk.

Content

Scanner excerpt · modules/coze_generate_image.py (reported line 139)May include surrounding context.

python
def detect_runtime_receive_target_from_tmux():
    try:
        proc = subprocess.run(
            ["tmux", "capture-pane", "-pt", "openclaw", "-S", "-300"],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The debug snapshot reveals which secrets are configured and returns runtime recipient-target metadata, providing attackers with operational intelligence about the environment. Even when values are partially masked by booleans, this materially aids reconnaissance and can expose user-routing context unrelated to the skill's purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code sends user-provided prompts and reference image URLs to an external image-generation service without any in-code notice, minimization, or consent flow. While external processing may be functionally necessary, it is still a real data-sharing behavior that can expose proprietary product information or user-supplied media.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · modules/coze_generate_image.py (reported line 432)May include surrounding context.

python
]

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
    except Exception as e:
        return {"ok": False, "error": "调用飞书发送脚本异常", "details": str(e)}

Tainted flow: 'cmd' from os.environ.get (line 423, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · modules/coze_generate_image.py (reported line 432)May include surrounding context.

python
]

    try:
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=180)
    except Exception as e:
        return {"ok": False, "error": "调用飞书发送脚本异常", "details": str(e)}