ClawHub
Back to skill

Security audit

亚马逊-前端商品详情

Security checks across malware telemetry and agentic risk

Overview

This skill mostly performs the advertised Amazon ASIN lookup, but it adds automatic feedback reporting and broad local persistence that users should review before installing.

Install only if you are comfortable sending ASIN lookup parameters, optional ZIP/location fields, session metadata, and your LinkFox API key to LinkFox services. Review or disable automatic feedback reporting if possible, and watch where the script writes saved responses and cache files, especially in shared projects or machines.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tainted flow: 'req' from os.environ.get (line 72, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urlopen(req, timeout=120) as response:
            return json.loads(response.read().decode("utf-8"))
    except HTTPError as e:
        body = e.read().decode("utf-8") if e.fp else ""
Confidence
89% confidence
Finding
with urlopen(req, timeout=120) as response:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs use of environment variables, local file writes, and network/API access, but does not declare permissions or clearly scope those capabilities. This weakens transparency and reviewability, making it easier for a skill to access local state or transmit data in ways a user or platform policy engine may not expect.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill adds automatic feedback reporting unrelated to the core product-detail lookup function, creating a secondary data flow that may transmit user interactions or task context to another API. Because this occurs 'without interrupting the user's flow,' users may be unaware that their content or opinions are being sent elsewhere.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The file documents a separate feedback-reporting endpoint that is unrelated to the skill's core purpose of retrieving Amazon product details by ASIN. In an agent setting, this expands the skill's effective capability surface and could cause the agent to transmit user content or conversation-derived data to an additional external service without a clear need, consent boundary, or purpose limitation.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A feedback submission capability is context-inappropriate for a product-detail lookup skill because it enables outbound transmission of free-form content unrelated to the requested ASIN lookup. In practice, an agent could be induced to send user statements, hidden prompts, or operational details to the feedback service, creating unnecessary data exfiltration and scope creep.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The skill writes full API responses, cache entries, and session metadata to local storage by default, which exceeds a narrow 'lookup product details' function and increases data retention risk. If responses contain account-linked metadata, usage information, or future sensitive fields, they remain on disk in predictable locations and may be accessible to other processes or users on the host.

Intent-Code Divergence

High
Confidence
77% confidence
Finding
The docstring promises that writing to /tmp is forbidden and that failure to write the current directory will error, but the implementation falls back to home and temporary directories. This mismatch can bypass operator expectations and security assumptions about where artifacts are stored, causing data to be written into less controlled locations such as shared temp space.

Vague Triggers

High
Confidence
89% confidence
Finding
The trigger language is intentionally broad and instructs activation even when the user does not explicitly ask for product-detail retrieval. Over-broad auto-triggering can cause unnecessary paid API calls, unexpected data access, and invocation in contexts where another safer or more appropriate skill should handle the request.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill mandates persistent JSON writes into the current working/project directory and ties paths to session identifiers, but does not provide a clear user-facing privacy/storage warning or consent step. This can leak queried product data, user task context, or session-correlated artifacts into local repositories or shared workspaces where they may persist unintentionally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The automatic feedback-reporting instructions describe transmitting feedback-related information to an API without a clear privacy disclosure or user consent. If user messages, dissatisfaction, or workflow context are included, this creates an undisclosed exfiltration path for conversational data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs sending authentication credentials in an Authorization header and may also send location-related data such as deliveryZip to an external service, but it provides no warning about this disclosure or its privacy implications. In an agent workflow, users may not realize that sensitive inputs and secrets are being transmitted off-platform, increasing privacy, compliance, and trust risks.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.