ClawHub
Back to skill

Security audit

Amazon Keyword Research

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Amazon research purpose, but its bundled script can execute unintended local code from a crafted keyword and its install/network behavior is under-scoped.

Review carefully before installing. Do not use this version with untrusted or externally supplied keywords, and prefer waiting for a fixed release that passes keyword values to Python as arguments, pins the install source, avoids global install by default, narrows triggers, and clearly discloses third-party keyword transmission.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/research.sh:36
Finding

User-Controlled Keyword Enables Arbitrary Python Code Execution

Content
View full analysis
"); # ``` After interpolation, the injected statement is parsed as part of the Python program. The unused `ENCODED_KW` assignment at line 36 is independently exploitable because command substitution executes the Python process even though its result is never subsequently used. The flaw is reached through the Skill's normal documented workflow, which instructs the Agent to pass a user-requested Amazon research keyword directly to this script. ### Attack Path 1. An attacker submits an Amazon research request containing a keyword crafted as Python syntax. 2. The Agent follows `SKILL.md` and invokes `scripts/research.sh` with tha ...[truncated 1053 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Global Installation from a Mutable Third-Party Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code accurately supports one portion of the description: retrieving Amazon autocomplete/long-tail keyword suggestions across 12 marketplaces without an API key. However, it does not implement competitor analysis, competition landscape evaluation, seasonal demand analysis, market opportunity assessment, keyword comparison logic, or any broader seller decision support. Its primary actual function is limited to collecting autocomplete suggestions via Amazon completion endpoints with simple prefix and alphabet expansion. Because the declared description substantially overstates the implemented analytical capabilities, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger guidance is extremely broad, directing activation for many direct and vague phrases like 'is this a good product to sell?' even when the user does not explicitly request keyword research. Overbroad triggers can cause unintended invocation of shell/network-enabled behavior, leading to unnecessary external requests, scope creep, and reduced user control over what tools are used.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/research.sh (reported line 41)May include surrounding context.

sh
for prefix in "" "best " "cheap " "top "; do
  SEARCH_TERM="${prefix}${KEYWORD}"
  ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${SEARCH_TERM}'))")
  RESULT=$(curl -s "https://completion.${DOMAIN}/api/2017/suggestions?mid=${MKT}&alias=aps&prefix=${ENCODED}" 2>/dev/null)
  if [ -n "$RESULT" ]; then
    echo "$RESULT" | python3 -c "
import sys, json

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/research.sh (reported line 62)May include surrounding context.

sh
for prefix in "" "best " "cheap " "top "; do
  SEARCH_TERM="${prefix}${KEYWORD}"
  ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('${SEARCH_TERM}'))")
  RESULT=$(curl -s "https://completion.${DOMAIN}/api/2017/suggestions?mid=${MKT}&alias=aps&prefix=${ENCODED}" 2>/dev/null)
  if [ -n "$RESULT" ]; then
    echo "$RESULT" | python3 -c "
import sys, json

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of both shell execution (<skill>/scripts/research.sh) and networked data collection (web_search, web_fetch) but does not declare any explicit tool scope or permissions. That creates an authorization gap where the runtime may grant broader-than-expected capabilities, making accidental or unsafe tool use harder to constrain or audit.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation command uses npx skills add ... without pinning a specific package or version, which exposes users to supply-chain risk from upstream changes or a compromised package at install time. Because npx fetches and executes code dynamically, an unexpected update could alter behavior or execute malicious code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script sends the user-supplied keyword directly to Amazon autocomplete endpoints, which is a real privacy issue because search terms may contain sensitive business ideas, product plans, or accidental personal data. There is no explicit consent, warning, or redaction before transmitting the input to a third party, and the skill’s purpose makes such disclosure likely during normal use.

Content

No source excerpt is available for this finding.