Mpstats Ozon Brand Products

PassAudited by ClawScan on May 6, 2026.

Overview

This appears to be a normal read-only API skill for Ozon brand metrics, but it uses a LinkFox API key and sends queries to LinkFox.

This skill looks coherent and purpose-aligned for read-only Ozon brand product analysis. Before installing, confirm you are comfortable providing a LinkFox API key and sending brand research queries to LinkFox. There is no evidence in the provided artifacts of hidden execution, persistence, file access, or data exfiltration beyond the documented API call.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Running the skill requires a LinkFox API key that may be tied to the user’s account or quota.

Why it was flagged

The helper reads a LinkFox API key from the environment and sends it in the Authorization header. This is purpose-aligned for the documented API, but it is delegated account access that users should manage carefully.

Skill content

key = os.environ.get("LINKFOXAGENT_API_KEY") ... "Authorization": api_key

Recommendation

Use a dedicated or scoped LinkFox key if available, store it securely, and revoke or rotate it if it is no longer needed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Brand names, filters, dates, sorting choices, and similar query details are sent to LinkFox to obtain results.

Why it was flagged

The skill sends the user’s brand query parameters to the external LinkFox tool gateway. This is disclosed and central to the skill’s function, but it is still a third-party data flow.

Skill content

API_URL = "https://tool-gateway.linkfox.com/mpstats/ozon/brandProducts" ... data = json.dumps(params).encode("utf-8")

Recommendation

Do not submit queries you consider confidential unless you are comfortable with LinkFox receiving them and have reviewed the provider’s terms or privacy expectations.