ClawHub
Back to skill

Security audit

Pangolinfo Amazon Niche Finder

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Amazon category research purpose, but it needs review because its instructions expose Pangolinfo API keys in risky ways.

Review the credential setup before installing. Prefer keeping the Pangolinfo key inside the MCP server or a secret manager, avoid putting JWTs in URLs or chat messages, and rotate the key if it has already been exposed in logs, shell history, or shared transcripts.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:172
Finding

Agent Is Instructed to Read a Sensitive API Credential from the Environment

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:172
Vulnerability Type: Credential access beyond the minimum requirements of the Agent
Risk Level: Medium

Vulnerable Instruction

text
Skill side (the form represented by this file): The AI reads the key from the
PANGOLINFO_API_KEY environment variable. This is the Skill's default key source;
the user configures it in the runtime environment, and the AI reads it directly.

The excerpt is an English rendering of the complete security-relevant instruction at line 172.

Technical Analysis

The Skill explicitly directs the AI Agent to read the raw PANGOLINFO_API_KEY credential from its runtime environment. This violates least-privilege design because Amazon category and niche analysis only requires authenticated MCP operations; it does not inherently require the language model or Agent context to receive the credential itself.

Credentials exposed to an Agent can become available to model context, command traces, tool-call logs, debugging output, telemetry, or later instructions operating within the same session. A prompt-injection payload encountered elsewhere in an Agent workflow could also attempt to make the Agent reveal or misuse any credential it has already accessed.

No evidence was found that this Skill directly transmits or prints the key. The vulnerability is the unnecessary instruction to expose the raw credential to the Agent rather than keeping authentication inside a trusted MCP server or credential broker.

Attack Path

  1. A user configures PANGOLINFO_API_KEY in the Agent's runtime environment.
  2. The Skill is loaded for an Amazon category or niche-analysis request.
  3. Following line 172, the Agent reads the raw environment variable.
  4. The credential enters an Agent-accessible execution or context boundary.
  5. A malicious subsequent instruction, compromised tool, verbose trace, or logging mechanism requests or captures the c ...[truncated 870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction requiring the AI to read PANGOLINFO_API_KEY.
  2. Keep the credential exclusively within the MCP server, a credential broker, or an operating-system secret manager.
  3. Expose only a non-sensitive authentication status to the Agent, such as authenticated, missing, or expired.
  4. Ensure MCP tools automatically attach authentication outside the model-visible argument payload.
  5. Prevent credentials from appearing in prompts, tool arguments, exception messages, traces, and telemetry.
  6. Redact JWT-shaped values from logs and diagnostic output.
  7. Use narrowly scoped, short-lived tokens where the service supports them.
  8. Rotate the credential if it has previously been exposed to model context or retained logs.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:173
Finding

API Credentials Are Permitted in URL Query Strings and Unprotected Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:173-183 and SKILL.md:394
Vulnerability Type: Insecure credential storage and transport guidance
Risk Level: Medium

Vulnerable Instructions

text
MCP server side: The key may be supplied through the CLI --api-key option, the
PANGOLINFO_API_KEY environment variable, ~/.pangolinfo/config.json, a hosted URL
using ?api_key=<key>, or the Authorization: Bearer <key> HTTP header.

MCP form: Write the key into ~/.pangolinfo/config.json, put it in the MCP URL as
?api_key=eyJhbGci..., or use the Authorization: Bearer eyJhbGci... header.

The excerpts are English renderings of the complete security-relevant instructions at lines 173 and 183. The query-string recommendation is repeated at line 394.

Technical Analysis

The Skill recommends placing an authentication JWT in a URL query parameter. URL credentials are frequently retained or propagated through:

  • Reverse-proxy and web-server access logs.
  • Browser history and address-bar synchronization.
  • Monitoring, analytics, and observability systems.
  • Screenshots, copied links, support bundles, and shell history.
  • Referrer metadata, depending on client and redirect behavior.

Unlike an authorization header, a query parameter is routinely treated as ordinary URL metadata and therefore has a larger accidental-disclosure surface.

The Skill also permits storage in ~/.pangolinfo/config.json without specifying restrictive file permissions, ownership checks, symlink protections, or log-redaction requirements. If that file is created with permissive defaults, another local account or process may be able to read the JWT.

The file does not contain a hardcoded live credential. The finding concerns insecure credential-handling instructions that can cause users or integrating Agents to expose their own credentials.

Attack Path

URL leakage path:

  1. A user follows the Skill and con ...[truncated 1319 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove query-parameter authentication from all setup instructions.
  2. Require Authorization: Bearer <token> over TLS for remote MCP connections.
  3. Prefer an operating-system keychain, dedicated secret manager, or MCP-native credential store over plaintext JSON.
  4. If a local configuration file must be supported:
    • Create it with mode 0600.
    • Verify that it is owned by the expected user.
    • Reject symbolic links and files writable by other users.
    • Store only the minimum required secret material.
  5. Do not pass the token through command-line arguments because process listings and shell history may expose it.
  6. Configure clients, proxies, and servers to redact api_key, Authorization, and JWT-shaped values from logs.
  7. Add explicit instructions never to paste complete credentials into chat messages, reports, screenshots, or support requests.
  8. Provide token revocation and rotation guidance for users who previously placed credentials in URLs.
  9. Where possible, replace long-lived JWTs with short-lived and narrowly scoped credentials.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill text claims there is no API key environment variable usage, but later explicitly instructs the agent to read PANGOLINFO_API_KEY from the environment. This inconsistency can mislead reviewers and users about secret handling, and normalizes secret access by the agent without clear disclosure or least-privilege boundaries.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
## 🎯 示例 Prompt / Quick-start prompts

- "浏览 'Home & Kitchen' 类目树，找低竞争子类目，列 Top 5 利基。" / "Walk the Home & Kitchen tree, find low-competition niches, list top 5."
- "搜 'headphones' 类目，把节点路径解析出来。" / "Search 'headphones' categories and resolve their full paths."
- "找搜索量 >2 万、Top5 点击份额 <40%、退货率 <10% 的蓝海利基。" / "Find niches with >20k search volume, <40% top-5 click share, <10% return rate."

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to read PANGOLINFO_API_KEY from environment variables automatically and 'not repeatedly ask the user.' Even if intended for convenience, this is a secret-access pattern that bypasses explicit user opt-in and encourages the model to retrieve sensitive credentials from its execution environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.