ClawHub

Cn Ecommerce Search

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese e-commerce search connector, but installing it runs an external npm MCP package and searches may be sent to Shopme.

Before installing, make sure you trust the Shopme npm package and provider. Avoid using it for confidential sourcing plans or private product research unless you are comfortable sending search terms and product URLs to Shopme's service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description uses broad activation language such as 'use when the user asks to find products' without clear scope boundaries, which can cause the agent to invoke the skill for generic shopping-related queries that may not require this external tool. This is not inherently malicious, but it increases unnecessary tool use and may expose user queries to the external Shopme service more often than intended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The 'When to Use' section enumerates broad shopping intents but does not define guardrails, required signals, or examples of when the skill should not be used. In an agent setting, this ambiguity can lead to over-activation and unnecessary transmission of user-provided product links or search terms to an external backend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal