ClawHub
Back to skill

Security audit

Amazon Market Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Amazon market research, but it should be reviewed because it loads a local .env file as executable shell code and stores API credentials/reports on disk.

Install only if you are comfortable providing a model API key and sending market-research queries to the configured external provider. Before use, review and protect the .env file, avoid putting shell commands in it, restrict it to owner-only permissions, and do not enter confidential product plans unless that third-party processing is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
run.sh:11
Finding

Arbitrary Shell Command Execution Through Sourced Environment File

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
run.sh:7
Finding

API Credential File Created Without Enforced Owner-Only Permissions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · HOW_TO_USE.md (reported line 25)May include surrounding context.

md
/amazon-market-research 调研一下午餐盒在美国Amazon市场值不值得做

首次使用前，请先填写 .env 中的模型配置。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · QUICK_START.md (reported line 19)May include surrounding context.

md
/amazon-market-research 调研一下午餐盒在美国Amazon市场值不值得做

首次使用前，请先填写 .env 中的模型配置。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.py (reported line 306)May include surrounding context.

python
/amazon-market-research 调研一下午餐盒在美国Amazon市场值不值得做

首次使用前，请先填写 .env 中的模型配置。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 7)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ ! -f "$SKILL_DIR/.env" ] && [ -f "$SKILL_DIR/ENV_TEMPLATE.txt" ]; then
  cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 8)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ ! -f "$SKILL_DIR/.env" ] && [ -f "$SKILL_DIR/ENV_TEMPLATE.txt" ]; then
  cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 14)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ ! -f "$SKILL_DIR/.env" ] && [ -f "$SKILL_DIR/ENV_TEMPLATE.txt" ]; then
  cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · run.sh (reported line 29)May include surrounding context.

sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ ! -f "$SKILL_DIR/.env" ] && [ -f "$SKILL_DIR/ENV_TEMPLATE.txt" ]; then
  cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.py (reported line 252)May include surrounding context.

python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"
INPUT="${1:-}"

if [ ! -f "$SKILL_DIR/.env" ] && [ -f "$SKILL_DIR/ENV_TEMPLATE.txt" ]; then
  cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
73% confidence
Finding

Sourcing .env executes the file as shell code, not just as data. If an attacker can modify .env or influence its contents, they can achieve arbitrary code execution in the context of the user running the skill, which is more dangerous than simple credential loading.

Content

Scanner excerpt · run.sh (reported line 11)May include surrounding context.

sh
cp "$SKILL_DIR/ENV_TEMPLATE.txt" "$SKILL_DIR/.env"
fi

if [ -f "$SKILL_DIR/.env" ]; then
  set -a
  # shellcheck disable=SC1091
  source "$SKILL_DIR/.env"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file communicates all operational instructions exclusively in Chinese, including setup and invocation guidance. Under the language/locale policy rule, forcing a specific language without offering user choice or documenting a justified locale restriction is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The README is entirely in Chinese and presents the skill behavior and invocation examples only in Chinese, without offering a language choice or noting that Chinese is required. This may violate a language/locale policy if users are expected to receive or interact in a forced language without explicit opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes a shell script and the static analysis indicates capabilities for environment access, file writing, and network use, but the manifest declares no explicit tool scope or permissions. This creates a trust and containment problem: users and hosting systems cannot tell what resources the skill may access, increasing the chance of unintended data exposure, uncontrolled outbound requests, or unsafe file writes when the script processes untrusted input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code copies an environment template into .env and then sources .env, which is a sensitive credential/configuration handling operation. There is no confirmation prompt, comment explaining the security impact, or user-facing output warning that local secrets will be loaded from this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script returns help and error text only in Chinese, which forces a specific language for user-visible interaction. The file does not provide an opt-in language choice or document that the skill is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and core prompts position this as an Amazon market research skill, but the parser explicitly recognizes Shopee, Lazada, TikTok Shop, Temu, and Walmart as supported platforms. That broader multi-platform capability is not justified by the stated purpose and could mislead users about the scope of analysis.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill is configured to send requests to an external API endpoint by default. External transmission is not inherently malicious, but in combination with user-provided market research queries and raw text forwarding, it creates a real confidentiality and third-party data handling risk.

Content

Scanner excerpt · skill.py (reported line 259)May include surrounding context.

python
model = os.environ.get("MARKET_MODEL", "").strip()

    if not base_url:
        base_url = "https://api.moonshot.cn/v1"
    if not model:
        model = "kimi-k2.5"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ENV_TEMPLATE.txt (reported line 6)May include surrounding context.

text
"首次使用前请先配置模型环境变量。\n\n"
                "请在当前 skill 目录下编辑 .env 文件，并填写：\n"
                "MARKET_API_KEY=你的key\n"
                "MARKET_BASE_URL=https://api.moonshot.cn/v1\n"
                "MARKET_MODEL=kimi-k2.5\n\n"
                "如果没有 .env，第一次运行 run.sh 时会自动生成。"
            )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.py (reported line 308)May include surrounding context.

python
"首次使用前请先配置模型环境变量。\n\n"
                "请在当前 skill 目录下编辑 .env 文件，并填写：\n"
                "MARKET_API_KEY=你的key\n"
                "MARKET_BASE_URL=https://api.moonshot.cn/v1\n"
                "MARKET_MODEL=kimi-k2.5\n\n"
                "如果没有 .env，第一次运行 run.sh 时会自动生成。"
            )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt requires a Chinese-language business report structure and Chinese section titles, which effectively imposes a specific language on all users. The file does not provide opt-in, language selection, or a documented region-specific justification for this locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code sends user-supplied content, including the raw request text, to an external model API without any explicit warning or consent flow in this file. Users may unknowingly submit confidential business plans, product ideas, or other sensitive text to a third-party service, creating a privacy and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The raw user input is embedded verbatim into the external model prompt, so any secrets, personal data, or confidential business details entered by the user are transmitted off-host. In this skill context, users are likely to include proprietary market ideas and strategy details, making data leakage more concerning.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says output is optimized for direct Feishu display, but the code also persists the full generated report to disk via save_report(). That creates an undisclosed data retention channel for potentially sensitive product plans or user-entered business information, increasing exposure if the host is shared or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The comments instruct the user in Chinese and recommend a specific interface without any indication that other languages are supported. Under the policy rule, forcing or assuming a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The markdown states that the skill will 'automatically save' a local markdown report file, which is a file-write operation affecting the user's filesystem. The README does not disclose where the file is written, whether existing files may be overwritten, or provide any caution about this behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.