Security audit

Price Monitor Skill

Security checks across malware telemetry and agentic risk

Overview

The advertised Lite price-search skill includes under-disclosed Pro-style monitoring, third-party notification code, and an unrelated ClawHub login script, so it should be reviewed carefully before installation.

Install only if you are comfortable reviewing and controlling the extra scripts. The Lite search script appears aligned with the stated purpose, but the package also includes a broader monitor and a ClawHub login script; avoid running those unless you understand why they are needed, and do not add Feishu or Telegram credentials unless you intend price reports and keywords to be sent there.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises file and network-capable behavior without declaring any permissions, which weakens transparency and consent boundaries for users and reviewers. In a commerce-monitoring skill, hidden network access and file reads can enable undisclosed data collection, external communication, or retrieval of remote instructions beyond the stated feature set.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared Lite functionality is limited to manual Taobao/Pinduoduo price search, but the analyzed behavior reportedly includes JD support, threshold-based monitoring, external notifications, and login to an outside service. This mismatch is dangerous because it indicates concealed functionality and possible exfiltration or account interaction that users did not authorize, especially when coupled with network activity.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script performs an explicit `clawhub login` operation even though the stated skill purpose is basic e-commerce price monitoring. Introducing authentication capability expands the skill's privilege boundary and could enable account access, token creation, or use of protected platform features unrelated to the declared functionality. Logging the login flow to `/tmp` also increases exposure of authentication output if sensitive data is emitted.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script sends price-monitoring reports, including user-supplied keywords and pricing results, to external Feishu and Telegram endpoints, but this outbound transmission is not reflected in the skill description. Hidden or under-disclosed exfiltration paths are dangerous because users may provide sensitive search terms or internal product tracking targets without realizing the data will be forwarded to third parties.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The notification functions transmit collected keywords and pricing data to third-party services without an explicit nearby warning or consent flow. Even if the data seems low sensitivity, search terms can reveal business interests, procurement plans, or personal shopping intent, and sending them externally without clear disclosure creates a privacy and data-handling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.