ClawHub
Back to skill

Security audit

Ecommerce Advertising

Security checks for vulnerabilities and agentic risk

Overview

The skill's advertising-planning behavior is coherent, but its install instructions rely on unpinned global third-party skill installation and its web research can expose commercially sensitive inputs.

Review the install commands before running them. Prefer a pinned, verified, and non-global install where possible, and avoid giving sensitive competitor lists, product economics, or launch plans unless you are comfortable with those terms being used in external web searches.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Dependencies Installed with Global Scope

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:19-22, with additional occurrences at SKILL.md:353-362
Vulnerability Type: Unpinned third-party dependency and mutable skill source
Risk Level: Medium

Vulnerable Code

Primary installation command:

bash
npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-advertising -g

Additional recommended installation commands:

bash
npx skills add nexscope-ai/eCommerce-Skills --skill ecommerce-ppc-strategy-planner -g
bash
npx skills add nexscope-ai/Amazon-Skills --skill amazon-ppc-campaign -g

Technical Analysis

The documented commands invoke the skills package through npx without pinning the package to a verified version. They also identify third-party skill repositories by mutable repository names rather than immutable commit hashes or signed releases.

Consequently, the components retrieved when a user runs these commands can differ from the components reviewed during this audit. The -g option gives the installation global scope within the applicable skill environment, increasing the reach and lifetime of any compromised content.

This is a supply-chain trust issue. An npm package compromise, repository account takeover, malicious upstream release, or unauthorized modification of the referenced skill could introduce behavior not present in the audited project. The current artifact does not itself contain a malicious payload, and exploitation therefore depends on a future or existing compromise of an external distribution source.

Attack Path

  1. An attacker compromises the npm package resolved by npx, an associated publishing account, or one of the referenced third-party repositories.
  2. The attacker publishes a modified package or skill containing malicious installation logic or hostile skill instructions.
  3. A user follows one of the documented commands.
  4. npx resolves and runs the unpinned package, w ...[truncated 966 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to an explicitly reviewed version, for example by using a version-qualified package reference rather than an unversioned npx skills invocation.
  2. Pin each referenced skill repository to an immutable commit hash or cryptographically signed release tag.
  3. Publish and verify checksums or signatures for downloaded skill artifacts before installation.
  4. Replace global installation with a project-local or isolated installation unless global availability is strictly required.
  5. Run installation with a non-privileged account and restrict filesystem, network, and credential access through sandboxing.
  6. Configure package-manager lockfiles and approved registries where supported.
  7. Audit installation scripts and retrieved skill contents before activation.
  8. Document the expected package publisher, repository owner, version, commit, and integrity hash so users can detect unexpected source changes.
  9. Apply the same controls to the related-skill commands at SKILL.md:353-362.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The install command uses npx skills without any version pinning or integrity constraint, so execution will resolve whatever package/version is current at install time. That creates a supply-chain risk: a compromised or maliciously updated package could execute arbitrary code on the user's machine during installation or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill explicitly asks for competitor ASINs or brand names and then instructs use of external web tools to fetch competitor pages, ad libraries, and review content without warning the user that supplied business-sensitive inputs may be transmitted to third-party services. In this e-commerce strategy context, competitor targets, market focus, and research interests can be commercially sensitive, so silent transmission creates a privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This command again instructs users to run npx skills without pinning a version, introducing the same non-deterministic package resolution and supply-chain exposure. Because it appears in a recommended related-skill install path, users may execute it with high trust and little scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill includes a third unpinned npx skills execution path, which expands the attack surface by repeating an unsafe installation pattern. If the referenced package or dependency chain is hijacked, users could run attacker-controlled code simply by following the documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.