Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its Amazon listing-grader purpose, but it sends a long-lived service key to a user-configured external API endpoint without validating that destination.
Review before installing. Only use a CLAW_API_BASE value from a trusted provider, prefer HTTPS, protect and rotate the CLAW_KEY, and expect each run to send the key and requested ASIN URL to that external scraping service. Pin dependencies before production use.
scripts/grade.py:2Unpinned Runtime Dependency Creates a Supply-Chain Risk
scripts/grade.py:28Unvalidated API Base Can Redirect Credentials to an Arbitrary Endpoint
The script reads CLAW_API_BASE from a local .env/environment and uses it directly as the destination for an authenticated HTTP request containing the CLAW_KEY and target URL. If that variable is modified, the skill will send secrets and user-request metadata to an attacker-controlled endpoint, creating an SSRF/exfiltration path. The skill context makes this more dangerous because users expect a simple ASIN grader, not hidden trust in an arbitrary third-party API base.
def fetch_pdp(asin: str) -> dict:
url = f"https://www.amazon.com/dp/{asin}"
print(f"Fetching {url} ...", file=sys.stderr)
resp = httpx.post(
f"{CLAW_API_BASE}/api/scrape",
json={"claw_key": CLAW_KEY, "url": url, "mode": "scraper"},
timeout=90,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"""
Grade an Amazon product listing on a 0-100 scale.
Usage: grade.py <ASIN>
Requires env vars: CLAW_KEY, CLAW_API_BASE (set in the skill's .env file)
"""
import os
import sys
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"""
Grade an Amazon product listing on a 0-100 scale.
Usage: grade.py <ASIN>
Requires env vars: CLAW_KEY, CLAW_API_BASE (set in the skill's .env file)
"""
import os
import sys
At this line the script locates a local .env file and proceeds to load entries into process environment, giving the skill access to secrets stored beside the project. In isolation this is a common pattern, but in a skill that also performs outbound requests it creates a credential-access capability that may exceed user expectations and can facilitate secret misuse if the skill or environment is tampered with.
from pathlib import Path
import httpx
# Load skill .env (next to this script's parent directory)
_env_path = Path(__file__).parent.parent / '.env'
if _env_path.exists():
with open(_env_path) as _f:
Opening and reading the local .env file is part of the skill's credential-access behavior. Combined with later use of those values in network requests, this means the skill can ingest local secrets and potentially disclose them externally. The skill context makes this more suspicious because credential access is not inherent to merely calculating a listing quality score.
import httpx
# Load skill .env (next to this script's parent directory)
_env_path = Path(__file__).parent.parent / '.env'
if _env_path.exists():
with open(_env_path) as _f:
for _line in _f:
The skill explicitly requires a secret key in a local .env file and references an external API base, which indicates network access and use of environment-provided secrets, yet it declares no tool scope or permission boundaries. This creates an unnecessary trust gap: an agent or reviewer cannot tell from the manifest that the skill may access secrets and make outbound requests, increasing the risk of unintended data exposure or unreviewed external communication.
The trigger list contains broad natural-language phrases such as 'listing analysis', 'listing score', and generic multilingual scoring terms that could match ordinary user conversation and invoke the skill unexpectedly. In a skill that uses an external key and likely performs network requests, overbroad triggering raises the chance of unintended activation, unnecessary secret-backed API calls, or confusing behavior.
The skill loads local credentials from .env and depends on a paid third-party scraping service even though its advertised function is just to score an Amazon listing from an ASIN. This expands the trust boundary unnecessarily and can expose secrets and user activity to an external provider without clear justification or transparency. In this skill context, the mismatch between stated purpose and actual capability increases risk.
The script automatically reads secrets from a local .env file without any explicit user-facing warning or consent flow. While reading configuration is common, in an agent skill this can surprise operators by expanding access to local sensitive data and combining it with outbound network behavior. The context makes it somewhat more dangerous because the skill is marketed as a simple listing grader, not as something that accesses local credentials.
The manifest presents the skill as a direct ASIN-to-score grader, but the actual implementation delegates data retrieval to a separate remote scraping service via HTTP POST. Network retrieval is expected for this use case, but the reliance on an external scraper is still a meaningful behavior not reflected in the description.