Cn Ecommerce Search

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or configuring the skill may execute code from an external npm package that is not visible in the provided artifact set.

Why it was flagged

The skill's setup uses npx to run an npm-hosted MCP server package, while the submitted artifacts include only SKILL.md and no package code or lockfile.

Skill content
"command": "npx", "args": ["-y", "@shopmeagent/cn-ecommerce-search-mcp"]
Recommendation

Only install it if you trust the Shopme npm package and maintainer; consider reviewing or pinning the package version before use in sensitive environments.

What this means

Product keywords, product URLs, or supplier-research queries may be sent to Shopme's service when using the search/detail tools.

Why it was flagged

The documented search and detail tools rely on an external Shopme-backed product database, and SKILL.md also lists the default endpoint as https://api.shopmeagent.com.

Skill content
Search and retrieve product information across 8 Chinese e-commerce platforms via the Shopme unified product database.
Recommendation

Avoid submitting confidential sourcing plans, private product links, or sensitive business research unless you are comfortable sharing those queries with the external provider.