ClawHub
Back to skill

Security audit

Ecommerce Website Data

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate ecommerce data API client, but its setup encourages exposing an API token in chat and it enables contact-data lookup without enough privacy or responsible-use guidance.

Review before installing. Use a protected credential mechanism or environment variable and do not paste a real APEX_TOKEN into chat. Treat returned emails, phone numbers, and LinkedIn contact data as personal or sensitive business data, and use it only where lawful and appropriate for your outreach or research purpose.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

API Token Exposure Through Agent Conversation Setup Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:72-75
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Snippet

text
Paste this to your OpenClaw agent and it will install the skill and configure the token for you:

> Install this skill: https://clawhub.ai/roger52027/ecommerce-website-data
> My APEX_TOKEN is: your_token_here

The same unsafe guidance is duplicated in README.md:20-24.

Technical Analysis

The setup instructions explicitly encourage users to submit a live APEX_TOKEN through an agent conversation. This unnecessarily places the secret in model context and may expose it to conversation history, application logs, telemetry, debugging records, prompt transcripts, or tools and integrations that can access the session.

The skill itself supports safer credential mechanisms, including the APEX_TOKEN environment variable and OpenClaw configuration. Therefore, transmitting the token in natural-language chat is not required for the declared e-commerce API functionality and violates least-exposure principles for credentials.

The bundled client reads the token from the environment and sends it over HTTPS to the fixed ECcompass API host. That behavior is declared and necessary. The vulnerability is specifically the documentation’s recommendation to disclose the credential in chat, not the authenticated API request.

Attack Path

  1. A user follows the documented “Quickest Way” setup.
  2. The user replaces your_token_here with a valid APEX_TOKEN and submits it to the agent.
  3. The plaintext token becomes part of the conversation context and may be retained in chat history, logs, telemetry, or debugging systems.
  4. An unauthorized party, compromised integration, or tool with access to those records extracts the token.
  5. The attacker replays the token in the APEX_TOKEN HTTP header against https://api.eccompass.ai/public/api/v1/.
  6. The attacker ...[truncated 716 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all instructions asking users to paste APEX_TOKEN into an agent conversation, including the duplicate guidance in README.md:20-24.
  2. Require credential entry through a dedicated secret manager, protected credential prompt, or configuration interface that prevents the value from entering model context.
  3. Retain environment-based configuration, but advise users to set the variable outside recorded shell history where possible.
  4. Store persistent credentials using restrictive file permissions and a secret-reference mechanism rather than embedding plaintext directly in general configuration.
  5. Add an explicit warning such as: “Never paste API tokens into chat, prompts, logs, source files, or support messages.”
  6. Ensure logs and error messages never include request headers or token values.
  7. Support token revocation, rotation, expiration, and least-privilege scopes. Advise users who followed the prior instructions to revoke and replace exposed tokens.
  8. Consider automated secret redaction for conversation transcripts and telemetry as defense in depth.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (39)

Tainted flow: 'req' from os.environ.get (line 32, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/query.py (reported line 37)May include surrounding context.

python
"Content-Type": "application/json",
    })
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        raw = e.read().decode() if e.fp else ""

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The setup instructions explicitly tell users to paste their API token into agent chat, which can expose credentials to logs, conversation history, plugins, or downstream processing. This is a direct secret-handling anti-pattern because chat is not a safe credential entry channel unless the platform provides a dedicated secret input mechanism.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md
- [AI Instructions](SKILL.md) — How the agent uses this skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · claw.json (reported line 12)May include surrounding context.

json
],
  "credentials": {
    "APEX_TOKEN": {
      "description": "ECcompass API access token. Sign up at https://eccompass.ai, then go to Dashboard → API Access → Create Token.",
      "required": true
    }
  },

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly promotes obtaining decision-maker emails and LinkedIn contacts but provides no privacy, lawful-use, or consent guidance. In an agent ecosystem, this increases the chance the skill will be used for scraping, profiling, or unsolicited outreach in ways that may violate privacy expectations or policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README instructs users to paste their APEX_TOKEN directly into agent chat for installation. Supplying secrets through chat exposes them to logging, transcript retention, prompt injection, unintended tool access, or later disclosure by the agent, making credential compromise materially more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md
> Install this skill: https://clawhub.ai/roger52027/ecommerce-website-data
> My APEX_TOKEN is: your_token_here

Get your free token at [eccompass.ai](https://eccompass.ai) → Dashboard → API Access → Create Token.

### Manual Install via OpenClaw CLI

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares required environment access and clearly depends on outbound network communication, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens platform-level containment and review because the runtime capabilities are broader than what is formally documented for operators and users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises extraction of decision-maker emails and verified LinkedIn contacts without any user-facing privacy, compliance, or acceptable-use warning. In context, this increases the risk of misuse for scraping, profiling, or unsolicited outreach involving personal data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The instructions recommend storing the API token persistently in OpenClaw configuration, which increases the window of exposure if the local account, filesystem, backups, or config inspection is compromised. Persistent secret storage can be acceptable only when paired with a secure secret store, encryption, and access controls, none of which are described here.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
> Install this skill: https://clawhub.ai/roger52027/ecommerce-website-data
> My APEX_TOKEN is: your_token_here

Get your free token at [eccompass.ai](https://eccompass.ai) → Dashboard → API Access → Create Token.

### Manual Install via OpenClaw CLI

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

Authentication: APEX_TOKEN header (NOT Authorization header).

bash
curl -X POST https://api.eccompass.ai/public/api/v1/search \
  -H "APEX_TOKEN: $APEX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
73% confidence
Finding

Unlike the general endpoint references, this contact-retrieval endpoint is specifically used to obtain personal data including names, positions, emails, and LinkedIn URLs. In context, outbound retrieval of personal contact information without accompanying privacy controls or use restrictions increases compliance and abuse risk.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

Returns the list of apps/plugins installed on a store with details: name, rating, install count, vendor info, pricing plans. Use when the user asks "what apps does X use" or "which plugins are installed".

5. LinkedIn Contacts — GET https://api.eccompass.ai/public/api/v1/contacts/{domain}

bash
curl -H "APEX_TOKEN: $APEX_TOKEN" https://api.eccompass.ai/public/api/v1/contacts/ooni.com

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The skill states it returns verified LinkedIn contacts and business emails for lead generation and outreach, which materially raises privacy and anti-abuse concerns. In this context, the external transmission is not merely operational; it enables collection of personal contact data with limited safeguards.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

5. LinkedIn Contacts — GET https://api.eccompass.ai/public/api/v1/contacts/{domain}

bash
curl -H "APEX_TOKEN: $APEX_TOKEN" https://api.eccompass.ai/public/api/v1/contacts/ooni.com

Returns verified LinkedIn contacts for a domain's company: name, position, email, LinkedIn profile URL. Use for lead generation, decision-maker lookup, or outreach.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

These examples instruct users to query domains and export full analytics/JSON from a third-party service without any disclosure that search terms, target domains, and resulting business intelligence are sent to an external API. In a skill focused on competitor analysis and decision-maker contacts, users may submit sensitive investigative targets or proprietary research subjects, creating a real data-exposure and privacy risk through omission of warning and consent cues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The curl example demonstrates use of a live authentication token header for an external API but gives no credential-handling precautions or warning about transmitting data off-platform. This can normalize unsafe copy/paste behavior, increase accidental token disclosure in shells/logs, and obscure the fact that both credentials and query payloads are being sent to a remote service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The explicit external endpoint reference confirms that data leaves the local environment and is sent to a remote domain. In this skill's context—competitor analysis, store analytics, and contact discovery—that external transmission can reveal sensitive commercial intent or research targets even if the API itself is legitimate.

Content

Scanner excerpt · references/examples.md (reported line 158)May include surrounding context.

Example 9: Direct API Call (curl)

bash
curl -X POST https://api.eccompass.ai/public/api/v1/search \
  -H "APEX_TOKEN: $APEX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The explicit external endpoint reference confirms that data leaves the local environment and is sent to a remote domain. In this skill's context—competitor analysis, store analytics, and contact discovery—that external transmission can reveal sensitive commercial intent or research targets even if the API itself is legitimate.

Content

Scanner excerpt · references/examples.md (reported line 158)May include surrounding context.

Example 9: Direct API Call (curl)

bash
curl -X POST https://api.eccompass.ai/public/api/v1/search \
  -H "APEX_TOKEN: $APEX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md
---

## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search`

### Request

Static analysis

No suspicious patterns detected.