ClawHub
Back to skill

Security audit

Brand Protection Amazon

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Amazon brand-protection helper with visible, purpose-aligned behavior, though its install command should be treated as a supply-chain caution.

Before installing, verify the `skills` package and the `nexscope-ai/eCommerce-Skills` repository, prefer a pinned version or commit if available, and avoid running the install command with elevated privileges. Treat generated legal complaint templates as drafts for human review before sending them to Amazon or sellers.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Installation with Global Scope

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Supply-chain exposure through an unpinned package runner and mutable external repository
Risk Level: Medium

Vulnerable Code

bash
npx skills add nexscope-ai/eCommerce-Skills --skill brand-protection-amazon -g

Technical Analysis

The documented installation command invokes the skills package through npx without specifying an audited package version. It also installs skill content from nexscope-ai/eCommerce-Skills without pinning an immutable commit or verifying its integrity. Both dependencies may therefore resolve to content different from the content examined during this audit.

The -g option requests global installation, increasing the installation's scope and potentially exposing other projects or users of the same environment to compromised content. This finding concerns the documented installation chain; no malicious behavior was identified in the local Python files.

Attack Path

  1. An attacker compromises the package resolved by npx, its publishing account, or the referenced external repository.
  2. The attacker publishes or commits altered installation logic or skill content.
  3. A user follows the installation command in SKILL.md.
  4. npx resolves and executes the mutable package version, which retrieves or installs mutable repository content.
  5. The compromised component executes with the invoking user's privileges or places attacker-controlled content in the global skill environment.
  6. Subsequent skill use may execute the installed payload or expose other projects using the global installation.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running the installation command. The attacker could modify files accessible to that user, steal user-accessible data or credentials, install malicious skill content, or compromise later sessions that consume the global installation.

T ...[truncated 283 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the package runner to a reviewed version, for example by using an exact skills package version rather than allowing npx to resolve the latest release.
  2. Pin the external repository to an immutable commit hash or signed release instead of a mutable branch.
  3. Require checksum, signature, or provenance verification before installation.
  4. Remove global installation as the default; prefer a project-local, isolated environment with least privilege.
  5. Use a lockfile or equivalent dependency manifest that records exact versions and integrity hashes.
  6. Document the expected publisher, repository, revision, and verification procedure.
  7. Review dependency updates before changing pinned versions, and automate supply-chain scanning in CI.
  8. Avoid running the installation command with administrative privileges.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command uses npx skills without pinning an exact package version, which can cause users to execute whatever version is currently resolved from the registry at install time. If the upstream package is compromised, typo-squatted, or updated with malicious code, the user may run unreviewed code during installation with the same privileges as their shell.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code hardcodes the output language to English unless the caller explicitly provides a --zh flag. Under the policy, forcing a specific language without presenting a user choice or documented locale justification is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code selects English by default and only switches to the alternate language when a specific '--zh' flag is present. That creates a built-in language preference in the skill behavior rather than offering a neutral user choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.