Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Amazon Competitor Intelligence Monitor
v1.1.1Deep competitor intelligence for Amazon sellers with continuous monitoring. Two modes: Full Scan (complete analysis, 28-35 credits) and Quick Check (lightwei...
⭐ 0· 31·0 current·0 all-time
by@apiclaw
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
high confidencePurpose & Capability
Name, description and code consistently implement Amazon competitor monitoring using the APIClaw service. Declared requirement APICLAW_API_KEY matches the API client (scripts/apiclaw.py) and SKILL.md. Endpoints and outputs in reference.md align with described capabilities.
Instruction Scope
Runtime code (quick_check.py + scripts/apiclaw.py) performs expected actions: calls APIClaw endpoints, diffs snapshots, writes baseline/history, and prints alerts. However quick_check.py hardcodes an absolute DIR path to a developer/user home directory rather than using relative skill paths or the {skill_base_dir} placeholder in SKILL.md. quick_check.py also programmatically reads monitor-data/config.json and sets APICLAW_API_KEY from it — meaning the included config file (not the user-provided env var) can be used at runtime. These behaviors deviate from the SKILL.md's stated model of requiring the APICLAW_API_KEY from the environment and create scope creep (automatic use of an embedded key and external writes to that hardcoded path).
Install Mechanism
This is instruction-only (no installer/downloader), so nothing is fetched from third-party URLs during install. Code files are bundled in the skill; that lowers supply-chain risk compared to remote downloads, but bundled scripts will run network requests to api.apiclaw.io when invoked.
Credentials
The declared credential (APICLAW_API_KEY) is appropriate for the stated purpose. However, the package includes a concrete api_key value inside monitor-data/config.json and quick_check.py sets os.environ['APICLAW_API_KEY'] from that file — so the skill will run using an embedded key rather than requiring the user to supply theirs. An embedded key in repository files is disproportionate and risky (it may be a live key, could be used without your consent, could leak, or could incur charges).
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or global agent settings. It writes/updates local files (baseline.json, history/) inside its monitor-data directory — expected for a monitoring skill. The SKILL.md's Auto-Monitor suggestion to create scheduled tasks is normal for monitoring functionality but should be enabled only with explicit user consent.
Scan Findings in Context
[hardcoded_api_key_in_config] unexpected: monitor-data/config.json contains an api_key value that looks like a live APICLAW key. For this skill the user-supplied APICLAW_API_KEY would be expected instead of an embedded key; using a bundled key is unexpected and risky.
[absolute_path_hardcoded] unexpected: quick_check.py defines DIR as an absolute path pointing to '/Users/gutingyi/.openclaw/...'. This is inconsistent with SKILL.md's use of {skill_base_dir} and suggests the code was copied from a developer environment and may write or read from a location outside the user's skill directory.
[exec_subprocess_call] expected: quick_check.py uses subprocess.run to invoke scripts/apiclaw.py for per-ASIN API calls. Executing the packaged CLI script is expected for this skill, but callers should review subprocess behavior before running.
[writes_local_data_files] expected: The skill writes baseline.json and history/*.json in monitor-data/; storing snapshots is expected for a monitoring skill but means the skill will create persistent files locally.
What to consider before installing
What to check before installing or running this skill:
- Do not run the packaged scripts without review. The quick_check.py uses an embedded api_key inside monitor-data/config.json and will set APICLAW_API_KEY from that file. That means the skill can run using a key bundled in the package rather than a key you provide. Treat that embedded key as sensitive — it could be live and could be abused or consume someone else's credits.
- Remove or replace the embedded key before use. Delete monitor-data/config.json or replace its api_key with your own, then export APICLAW_API_KEY in your environment. Prefer placing a config.json in the skill root only if you understand the contents.
- Fix the hardcoded absolute path. quick_check.py points to a developer-specific path; change it to use relative paths based on __file__ or the SKILL.md {skill_base_dir} convention so files are stored inside the installed skill directory on your system.
- If you plan to enable scheduled Auto-Monitoring, only do so after addressing the above issues and confirm which API key will be used and where history/baseline files will be written.
- If you already ran the scripts with the embedded key, consider the embedded key compromised: rotate it (if it belongs to you) or contact APIClaw support to report misuse. If you are unsure whether the embedded key is valid, assume it could be used by others and do not rely on it.
- If you want assistance: ask for a checklist or a sanitized version of quick_check.py that uses relative paths and requires APICLAW_API_KEY from env/config without defaulting to bundled credentials.Like a lobster shell, security has layers — review code before you run it.
latestvk972f3x45kkt7k0fx25ngvbbdx84s0by
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
EnvAPICLAW_API_KEY
Primary envAPICLAW_API_KEY