Amazon FBA Finder

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:51 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Amazon FBA analysis tool with dependency and disclosure weaknesses, but I found no hidden access, persistence, exfiltration, or destructive behavior.

Install only in a virtual environment, pin or review dependencies before use, keep real API keys out of shared files, and treat financial recommendations as decision support rather than authoritative advice. The current code appears partially stubbed, so verify functionality before relying on paid product claims.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Runtime Dependencies Expand the Supply-Chain Attack Surface

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6
Vulnerability Type: Uncontrolled dependency resolution and excessive dependencies
Risk Level: Medium

Vulnerable Code

text

requests>=2.31.0
beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0
aiohttp>=3.9.0

The same broad dependency set is also declared without versions in clawhub.json:29-36:

json

"dependencies": [
  "requests",
  "beautifulsoup4",
  "pandas",
  "numpy",
  "python-dotenv",
  "aiohttp"
]

Technical Analysis

The requirements use lower-bound constraints without upper bounds, exact pins, hashes, or a committed lockfile. Consequently, installations performed at different times can resolve to materially different dependency and transitive-dependency versions.

The implementation only imports aiohttp, while requests, beautifulsoup4, pandas, numpy, and python-dotenv are not used by the executable source reviewed during this audit. Even aiohttp is currently used only to create and close a client session; the product-search implementation does not issue an external request.

Installing unnecessary packages increases the number of package maintainers, distribution artifacts, native components, and transitive dependencies that must be trusted. Broad version ranges also allow a future compromised or incompatible release to be selected without a source-code change in this project.

No evidence was found that any dependency currently named by the project is malicious. The finding concerns unsafe and unnecessarily broad dependency resolution, not a confirmed malicious package.

Attack Path

1. A user follows the documented instruction to run pip install -r requirements.txt.
2. The package resolver selects the newest versions satisfying the lower-bound constraints.
3. A future compromised direct or transitive dependency, if published and sel ...[truncated 1169 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove requests, beautifulsoup4, pandas, numpy, and python-dotenv unless concrete runtime functionality requires them.
2. Reassess whether aiohttp is needed before external product search is implemented.
3. Pin all direct dependencies to reviewed versions through a reproducible lockfile.
4. Generate and verify package hashes, for example by using a hash-locked requirements file with pip --require-hashes.
5. Keep dependency declarations in requirements.txt and clawhub.json synchronized.
6. Use automated dependency scanning and update tooling to review security advisories before accepting upgrades.
7. Install and run the Skill in a least-privileged virtual environment or container rather than under an administrative account.
8. Add a release process that regenerates the lockfile, reviews transitive changes, and runs tests before publication.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/profit_calculator.py:78

Finding

Missing Numeric Input Validation Permits Invalid Financial Results and Recommendations

Content

View full analysis

Vulnerability Details

File Location: src/profit_calculator.py:78-151
Vulnerability Type: Improper input validation in financial calculations
Risk Level: Medium

Vulnerable Code

python

def calculate_profit(self,
                    selling_price: float,
                    product_cost: float,
                    dimensions: ProductDimensions,
                    shipping_cost: float = 0,
                    advertising_pct: float = 0.10,
                    monthly_sales: int = 300) -> ProfitAnalysis:
    """
    Calculate product profit.
    """
    # Calculate FBA fulfillment fee
    fba_fee = self._calculate_fba_fee(dimensions)

    # Calculate referral fee
    referral_fee = selling_price * self.REFERRAL_RATE

    # Calculate storage fee
    storage_fee = self._calculate_storage_fee(dimensions)

    # Calculate advertising cost
    advertising_cost = selling_price * advertising_pct

    # Other costs
    other_costs = selling_price * 0.03

    total_cost = CostBreakdown(
        product_cost=product_cost,
        shipping_to_amazon=shipping_cost,
        fba_fee=fba_fee,
        referral_fee=referral_fee,
        storage_fee=storage_fee,
        advertising_cost=advertising_cost,
        other_costs=other_costs,
        total_cost=(
            product_cost + shipping_cost + fba_fee +
            referral_fee + storage_fee + advertising_cost + other_costs
        )
    )

    net_profit = selling_price - total_cost.total_cost
    profit_margin = (net_profit / selling_price) * 100 if selling_price > 0 else 0

    investment = product_cost + shipping_cost
    roi = (net_profit / investment) * 100 if investment > 0 else 0

    fixed_costs = 0
    breakeven_units = int(fixed_costs / net_profit) + 1 if net_profit > 0 else 999999

    monthly_profit = net_profit * monthly_sales

    recommendation = self._generate_recommendation(
     
...[truncated 3257 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate all public inputs before performing any calculation.
2. Use math.isfinite for every floating-point input and reject NaN, positive infinity, and negative infinity.
3. Require selling_price to be greater than zero.
4. Require product cost and shipping cost to be non-negative.
5. Require length, width, height, and weight to be finite and greater than zero.
6. Restrict advertising_pct to a documented range, such as 0.0 through 1.0.
7. Require monthly_sales to be a non-negative integer and impose a practical maximum where appropriate.
8. Raise explicit TypeError or ValueError exceptions with field-specific messages rather than silently producing invalid output.
9. Consider using decimal.Decimal for monetary calculations and define a consistent rounding policy.
10. Add unit tests for zero, negative, extreme, wrong-type, NaN, and infinite values.
11. Apply equivalent validation to product-search filters, supplier prices, order quantities, and all other externally supplied numeric fields.
12. Ensure recommendations are generated only after all inputs and intermediate results pass validity checks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (28)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 125)May include surrounding context.

配置 API 密钥

bash

# .env 文件
AMAZON_API_KEY=your_amazon_api_key
ALIBABA_API_KEY=your_alibaba_api_key
MARKETPLACE=US  # US/UK/DE/JP/CA/AU

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README presents the product description and most user-facing documentation in Chinese, with only limited bilingual text in the title line. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language instructions, headings, warnings, and examples are all presented in Chinese, effectively forcing a specific language for use and comprehension. The file does not offer an alternative language, opt-in, or justification that this skill is intended only for a Chinese-language or region-specific audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to configure Amazon and Alibaba API keys and states it performs real-time queries to external platforms, but it does not clearly disclose what data is transmitted, how credentials are stored, or what privacy/security controls apply. This can lead users to expose sensitive business data or secrets to third-party services without informed consent, increasing the risk of credential misuse, data leakage, or unintended external sharing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is written entirely in Chinese, which imposes a specific language presentation without indicating that users can choose another language or that the skill is intended only for a Chinese-speaking audience. This matches the policy concern about language or locale constraints lacking user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language documentation and output strings exclusively in Chinese, including module descriptions and recommended strategy text. Under the policy, forcing a specific language without offering a language choice or documenting a justified locale constraint is a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing docstrings and recommendation strings in Chinese throughout the skill, including the main module description and class/method documentation. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains user-facing natural-language documentation that forces a specific language/locale context. The policy requires flagging language constraints when the skill does not offer user opt-in or clearly justify that it is region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language content entirely in Chinese, including the top-level module description and later user-facing output strings, but does not indicate that the skill is intentionally region-specific or provide any opt-in for language selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The _generate_recommendation method returns user-facing recommendation text only in Chinese. Because these are direct outputs to users and the file provides no mechanism to choose language or justify a locale restriction, this violates the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and user-facing text are presented only in Chinese, and the file does not indicate that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The package description is written entirely in Chinese, and the skill metadata shown in this file does not indicate that users can choose another language or locale. Because policy-violation checks apply to natural-language content in all file types, this can be flagged as a potential language/locale restriction without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill entry description is also fully in Chinese and does not state that the skill is region- or language-specific, nor does it offer alternatives. This creates the same policy concern that the skill may impose a specific language by default.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.31.0), which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the environment.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

requests has known advisories, but because the manifest does not pin an exact version, it is not possible to verify whether the installed release is affected. The main security issue in this file is the inability to prove that deployments avoid vulnerable versions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is unpinned (beautifulsoup4>=4.12.0), so installations are not deterministic and may pull in newer releases without review. This creates supply-chain risk and makes it harder to verify that deployed environments are free from known issues.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using pandas>=2.0.0 permits any later release, preventing reproducible builds and increasing the chance that a vulnerable or incompatible version is installed. Even if current minimum versions are acceptable, the unconstrained upper range expands the attack surface over time.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0
aiohttp>=3.9.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

pandas has at least one reported advisory, and the unpinned requirement prevents determining whether an affected version may be installed. This leaves the security posture unverifiable and weakens dependency governance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The requirement numpy>=1.24.0 is not fixed to a single release, so different environments may install different versions. That undermines reproducibility and may expose the application to newly introduced vulnerabilities or regressions in upstream packages.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

requests>=2.31.0
beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0
aiohttp>=3.9.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

numpy has multiple advisories, and the open-ended version specifier means different installs may receive different versions, including potentially affected ones. The danger is not a confirmed active exploit here, but the inability to assure safe dependency resolution.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

python-dotenv>=1.0.0 allows any future version to be installed, making it impossible to guarantee which code will run in production. This is a software supply-chain hygiene issue that can mask exposure to vulnerable releases.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

beautifulsoup4>=4.12.0
pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0
aiohttp>=3.9.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

python-dotenv is listed with advisories, and because only a minimum version is specified, the actual installed version cannot be validated from this file alone. This creates uncertainty about whether known issues are present in deployed environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The requirement aiohttp>=3.9.0 is unpinned, so package resolution may drift between environments and over time. This increases the risk of inadvertently consuming vulnerable or unstable upstream versions.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

pandas>=2.0.0
numpy>=1.24.0
python-dotenv>=1.0.0
aiohttp>=3.9.0

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

aiohttp has known advisories, but the manifest does not constrain it to a specific safe release. As a result, installs may resolve to versions with known security issues, and auditors cannot confirm safety from the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module-level docstring and author metadata are presented in Chinese, which suggests a fixed language choice in user-facing text without indicating any user language selection or opt-in. This can conflict with language/locale policy requirements when a skill is expected to respect user language preferences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.