Clawtrix Ecom Intel

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed e-commerce skill-recommendation workflow that reads local agent context and writes a report, with no hidden code, credential theft, destructive action, or profile exfiltration found.

Install only if you want an agent to generate e-commerce ClawHub skill recommendations. Before running it, confirm that reading SOUL.md and saving a recommendation report is acceptable, and avoid including raw credentials, customer data, or unnecessary operational details in the generated report.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:28

Finding

Overbroad Access to Agent Profile and Operational Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–36
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Relevant Code:

markdown

### Step 1 — Read Agent Mission

Read the agent's `SOUL.md`. Extract:

- **Ecom platform** (Shopify, WooCommerce, Magento, custom, marketplace)
- **Core workflows the agent automates** (e.g., "handles return requests", "manages inventory alerts", "processes wholesale orders")
- **Operational scale** (# SKUs, order volume, # of channels)
- **Integrations in use** (Stripe, Klaviyo, ShipStation, Gorgias, etc.)
- **Installed skills** (to avoid re-recommending)

Technical Analysis

The skill instructs the agent to read SOUL.md and collect a broad operational profile, including business scale, integrations, automated workflows, and installed capabilities. Reading this information is not strictly necessary for a basic public skill-catalog search, and the instructions do not require explicit user consent, field-level minimization, or verification that the target file is within the skill's authorized scope.

This creates a least-privilege concern: invocation of a recommendation skill implicitly authorizes access to agent identity and state information that may reveal sensitive architectural or commercial details. Integration names can identify high-value systems such as payment processors, while installed skills and workflow descriptions can disclose the agent's capabilities and potential attack surface.

The reviewed file does not instruct the agent to transmit the extracted SOUL.md data to ClawHub. Its external requests use fixed, generic search terms, so direct data exfiltration is not established. The risk is limited to unauthorized collection and possible retention of metadata in the agent's execution context or generated reports.

Attack Path

1. A user or automated workflow invokes the e-commerce discovery skill to o ...[truncated 1683 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before reading SOUL.md, and clearly enumerate the fields that will be accessed.
2. Prefer user-supplied inputs such as platform, operational focus, and installed skills instead of automatically reading agent identity or state files.
3. Apply data minimization. Only collect attributes required for the current search; omit operational scale and integration inventory unless they materially affect compatibility.
4. Validate that the resolved file path is the expected workspace-local SOUL.md; prohibit arbitrary paths, symbolic-link escapes, and traversal outside the authorized workspace.
5. Do not copy raw SOUL.md content into generated reports. Persist only the minimum conclusions needed to explain recommendations.
6. Define access controls and retention limits for files written under memory/reports/, especially when reports mention integrations or operational details.
7. Add an explicit prohibition against including profile data in ClawHub queries or sending it to any other external endpoint.
8. Record which fields were accessed and allow the user to review or redact them before recommendation generation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description and use conditions are broad enough to trigger on many generic e-commerce situations, with only a weak constraint of 'top 3 recommendations.' Over-broad invocation can cause the agent to run discovery, read SOUL.md, query external services, and write recommendation reports in contexts where this skill was not specifically intended, increasing unnecessary data exposure and unsafe skill-selection automation for high-risk e-commerce environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.