Back to skill
Skillv0.1.2
ClawScan security
Amazon Product Search Api Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 17, 2026, 10:58 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and required environment variable align with its stated purpose (using BrowserAct to fetch Amazon search results); nothing in the files indicates unexpected exfiltration or unrelated privilege requests.
- Guidance
- This skill sends your search parameters and the BrowserAct API key to api.browseract.com to run BrowserAct workflows — that's the intended behavior. Before installing: (1) Confirm you trust BrowserAct and are comfortable that the API key will be used for these queries; (2) Provide a scoped/rotatable BrowserAct key if possible (do not reuse high-privilege keys); (3) Ensure the agent environment has Python and the 'requests' library installed (the skill does not include a dependency installer); (4) Monitor usage/costs on your BrowserAct account and review rate limits/privacy policies. The only real inconsistency is a small metadata omission (no primary credential set) and the missing declared Python dependency; both are low risk but worth noting.
Review Dimensions
- Purpose & Capability
- okName/description say the skill uses BrowserAct to extract Amazon search results; the script calls api.browseract.com and posts the workflow template ID, which is coherent with that purpose. The single required env var (BROWSERACT_API_KEY) is appropriate.
- Instruction Scope
- okSKILL.md instructs the agent to run the provided Python script, monitor logs, and handle retries. The script only uses the provided API key and search inputs and communicates with BrowserAct endpoints. It doesn't read unrelated files, other env vars, or modify system/state outside its scope.
- Install Mechanism
- noteThere is no install spec (instruction-only), which minimizes risk. One mismatch: the script imports the third-party 'requests' library but the skill does not declare installing dependencies or bundling them; deploying agents must ensure a Python environment with 'requests' available. No downloads or external installers are invoked by the skill.
- Credentials
- noteThe skill requests a single, purpose-relevant credential (BROWSERACT_API_KEY), which is proportional. Minor metadata inconsistency: the registry lists no primary credential while the skill clearly requires BROWSERACT_API_KEY—this is likely an oversight but not a functional mismatch.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request persistent/system-wide privileges. It does not modify other skills or agent configs. Autonomous invocation is allowed (platform default) and acceptable here.