Mpstats Ozon Seller Products

PassAudited by ClawScan on May 6, 2026.

Overview

This skill is a coherent Ozon seller analytics integration, but it requires a LinkFox API key and sends queries to LinkFox-hosted APIs.

Before installing, confirm you trust LinkFox with your API key and Ozon seller query parameters. Keep the API key private, avoid including confidential information in feedback, and treat returned marketplace analytics as data rather than business advice.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Your seller IDs, date ranges, filters, and sorting choices are sent to LinkFox to retrieve the requested analytics.

Why it was flagged

The skill sends user-supplied seller query parameters to an external LinkFox tool gateway. This is expected for the stated analytics purpose and is clearly documented.

Skill content

请求地址：`https://tool-gateway.linkfox.com/mpstats/ozon/sellerProducts` ... 请求方式：POST，Content-Type: application/json

Recommendation

Use the skill only for queries you are comfortable sending to LinkFox, and avoid placing unrelated sensitive information in query parameters.

Note

ASI03: Identity and Privilege Abuse

What this means

You must provide a LinkFox API key for the script/API call to work, and that key authorizes requests to the LinkFox service.

Why it was flagged

The script reads a local API key and sends it in the Authorization header. This is purpose-aligned for calling the LinkFox API, though the registry metadata does not list a primary credential or required env var.

Skill content

key = os.environ.get("LINKFOXAGENT_API_KEY") ... "Authorization": api_key

Recommendation

Set the API key deliberately, keep it scoped to this service if possible, and do not share it in prompts or logs.

Note

ASI07: Insecure Inter-Agent Communication

What this means

If feedback reporting is used, some user feedback text may be sent to LinkFox's feedback API.

Why it was flagged

The references document a separate feedback endpoint that can receive user feedback content. It is disclosed, but it is outside the main Ozon seller-products query flow.

Skill content

POST `https://skill-api.linkfox.com/api/v1/public/feedback` ... `content`：用户表达、实际现象、为什么算问题或好评

Recommendation

Do not include secrets or private business details in feedback text unless you intend to share them with the skill provider.