Mpstats Ozon Product Search
PassAudited by VirusTotal on May 6, 2026.
Overview
Type: OpenClaw Skill Name: linkfox-mpstats-ozon-product-search Version: 1.0.0 The skill bundle is a legitimate tool for searching Ozon marketplace products via the MPSTATS analytics service. The Python script (mpstats_ozon_product_search.py) uses standard libraries to interact with a documented API endpoint (tool-gateway.linkfox.com) and follows secure practices by reading credentials from environment variables. The instructions in SKILL.md and the API documentation in references/api.md are consistent with the stated purpose of e-commerce product discovery and contain no evidence of malicious intent or harmful prompt injection.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Ozon search terms, SKUs, brand names, seller names, dates, and pagination parameters are sent to LinkFox's gateway.
The script sends the user-provided search request to a single external LinkFox gateway endpoint. This is disclosed and central to the skill's purpose, but it is still an external data flow users should notice.
API_URL = "https://tool-gateway.linkfox.com/mpstats/ozon/productSearch" ... with urlopen(req, timeout=60) as response:
Use the skill only for queries you are comfortable sending to LinkFox/MPSTATS, and avoid placing unrelated private information in search parameters.
Queries may run under your LinkFox account and could consume quota or expose account-scoped access if the key is shared or overprivileged.
The skill authenticates requests with a LinkFox API key read from the environment. This is expected for the MPSTATS gateway, but the registry metadata lists no required env vars or primary credential.
key = os.environ.get("LINKFOXAGENT_API_KEY") ... "Authorization": api_keyUse a dedicated LinkFox API key with the least needed access, store it securely, and revoke or rotate it if it is no longer needed. The skill metadata should declare LINKFOXAGENT_API_KEY.