Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Amazon Brand Analytics

Interpret and act on Amazon Brand Analytics data. Analyze Search Frequency Rank (SFR), click share, conversion share, market basket analysis, and repeat purc...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 47 · 0 current installs · 0 all-time installs
bynexscope-ai@nexscope
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (analyzing Amazon Brand Analytics metrics) aligns with an advisory/consulting skill that works from user-provided data. However the SKILL.md also claims support for many e-commerce platforms (Shopify, WooCommerce, Walmart, etc.) while the manifest requests no credentials or integration configuration — a mismatch that suggests the skill won't actually connect to those platforms itself and likely expects users to paste data. Additionally, the SKILL.md includes an `npx skills add ...` install command referencing an external package, but the registry entry contains no install spec or code files.
Instruction Scope
The runtime instructions are high-level: collect info from the user's message, ask one follow-up, research and analyze, then produce recommendations. They do not instruct the agent to read local files, environment variables, or external credentials. The instructions are vague about what 'research' entails (no explicit allowed endpoints or data sources), which gives the agent broad discretion but is consistent with a purely advisory skill.
!
Install Mechanism
There is no formal install spec in the manifest, but SKILL.md suggests installing an external package via `npx skills add nexscope-ai/eCommerce-Skills --skill amazon-brand-analytics -g`. That creates a disconnect: the package referenced may install code from npm/GitHub, yet this registry entry is instruction-only. Users following that install line would be executing an external installer not represented in this skill bundle. This is an incoherence and a potential supply-chain risk if you follow the published install step without verifying the external package.
Credentials
The skill declares no required environment variables, credentials, or config paths. For an advisory tool that expects the user to paste or describe Brand Analytics data this is proportional. If a user expects the skill to fetch Amazon or other platform data automatically, the lack of credential requirements is a mismatch and the skill will not be able to do that without additional setup.
Persistence & Privilege
No persistent or privileged settings are requested (always is false, no install spec in the manifest). The skill does not request to be always-enabled and there is no indication it modifies other skills or system configuration.
Scan Findings in Context
[no_regex_findings] expected: The static scanner had nothing to analyze because this is an instruction-only skill with no code files. Absence of findings does not imply safety; the SKILL.md contains an external install command which the scanner couldn't evaluate.
What to consider before installing
This skill appears to be a conversational/consulting helper that expects you to provide Amazon Brand Analytics data rather than fetch it automatically. Before installing or running the suggested `npx` command: 1) Understand that the registry entry contains no code — the SKILL.md's install line points at an external package you would be pulling from npm/GitHub; verify that repository and package before running it. 2) If you expect automatic integration with Amazon, Shopify, etc., ask the author how credentials are handled — the skill currently declares no credential requirements, so it likely cannot fetch data without additional setup. 3) Do not paste sensitive credentials or tokens into chat; provide only the data you want analyzed or authorize integrations via vetted connectors. 4) If you decide to install the external package, review its source code and publisher identity (nexscope-ai) and prefer installing from the official GitHub repository or an audited package. The main risks here are supply-chain (running an external installer referenced only in SKILL.md) and mistaken expectations about automatic platform integrations.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk9788xhtsr7d3jmsx97zcppd0x83g4ep

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Amazon Brand Analytics 📋

Interpret and act on Amazon Brand Analytics data. Analyze Search Frequency Rank (SFR), click share, conversion share, market basket analysis, and repeat purchase behavior to optimize your Amazon strategy.

Supported platforms: Amazon, Shopify, WooCommerce, Walmart, TikTok Shop, Etsy, eBay, BigCommerce.

Built by Nexscope — your AI assistant for smarter e-commerce decisions.

Install

npx skills add nexscope-ai/eCommerce-Skills --skill amazon-brand-analytics -g

Usage

Help me analyze my Amazon Brand Analytics data. My top search term has SFR #5,200 with 15% click share but only 8% conversion share. What should I do?

Capabilities

  • Search Frequency Rank (SFR) trend interpretation
  • Click share and conversion share analysis
  • Market basket analysis (frequently bought together insights)
  • Repeat purchase behavior patterns
  • Demographics data interpretation
  • Search term performance optimization recommendations

How This Skill Works

Step 1: Collect information from the user's message — product, platform, current situation, and goals.

Step 2: Ask one follow-up with all remaining questions using multiple-choice format. Allow shorthand answers (e.g., "1b 2c 3a").

Step 3: Research and analyze using the frameworks and methodology below.

Step 4: Deliver structured, actionable output with specific recommendations, not vague advice.

Output Format

  • Start with a summary of findings
  • Include specific data points and benchmarks where available
  • Provide prioritized action items
  • Mark estimates with ⚠️ when based on incomplete data
  • End with concrete next steps

Other Skills

More e-commerce skills: nexscope-ai/eCommerce-Skills

Amazon-specific skills: nexscope-ai/Amazon-Skills

Built by Nexscope — your AI assistant for smarter e-commerce decisions.

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…