Back to skill
Skillv1.0.0
ClawScan security
Sellersprite Market Research · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 29, 2026, 3:33 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's code and docs clearly call an external SellerSprite/LinkFox API and require an API key, but the skill metadata does not declare the required environment variable and the runtime instructions include automatic feedback reporting — these mismatches warrant caution before installing.
- Guidance
- This skill will send your market-research queries to LinkFox/SellerSprite endpoints and needs an API key supplied via the environment variable LINKFOXAGENT_API_KEY — but the skill metadata omitted that requirement. Before installing: 1) Confirm you are comfortable providing a LINKFOXAGENT_API_KEY and verify what that key can access on LinkFox. 2) Ask the skill author or repository owner to update metadata to declare LINKFOXAGENT_API_KEY so tooling can surface the requirement. 3) Be aware the skill is configured to auto-send feedback to https://skill-api.linkfox.com; clarify what feedback is sent and whether any user content or query parameters could be transmitted. 4) If you must protect sensitive context, avoid including secrets or PII in queries sent through this skill or restrict the agent from auto-sending feedback. If you want, I can suggest exact questions to ask the author or draft a safer SKILL.md/update that declares the env var and makes feedback reporting explicit and opt-in.
Review Dimensions
- Purpose & Capability
- noteThe skill name/description (SellerSprite market research) matches the code and API endpoints (tool-gateway.linkfox.com) and the provided script implements the described functionality. However, the skill metadata claims no required environment variables while both references/api.md and the included script expect LINKFOXAGENT_API_KEY — this is an inconsistency between declared requirements and actual needs.
- Instruction Scope
- concernSKILL.md and references/api.md instruct the agent to POST user-supplied query parameters to https://tool-gateway.linkfox.com/sellersprite/market/research and to call a feedback endpoint (https://skill-api.linkfox.com/api/v1/public/feedback) automatically when certain conditions occur. Automatic feedback reporting ('Do not interrupt the user's flow') could cause user-provided content or sensitive query context to be sent to the feedback endpoint without explicit user confirmation. Aside from network calls to the skill's service, the instructions do not read arbitrary local files or other environment variables.
- Install Mechanism
- okNo install spec — instruction-only plus an example script. No downloads or archive extraction; nothing is written to disk by an install process. This is a lower-risk delivery mechanism.
- Credentials
- concernThe skill actually requires an API key via environment variable LINKFOXAGENT_API_KEY (used in both references/api.md and the script) but the package metadata lists no required env vars. Requesting an API key for the external LinkFox endpoints is proportionate to the stated purpose, but the omission in metadata is a tooling/information inconsistency that may mislead users about what secrets they must provide. Also evaluate what privileges that API key grants on the LinkFox side before supplying it.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated or persistent system privileges. It does not modify other skills or system configuration. Autonomous invocation is permitted by default (normal for skills) but does not by itself increase the concern beyond the points already raised (automatic feedback sending).