ClawHub
Back to skill

Security audit

nike-research

Security checks across malware telemetry and agentic risk

Overview

This Nike research skill mostly matches its stated purpose, but its helper script is broader than advertised and can send arbitrary requests and data through Crawlora.

Review before installing. Use this only if you are comfortable sending Nike search terms, product identifiers, and store lookup coordinates to Crawlora. Avoid putting secrets or unrelated personal data in queries. The publisher should narrow scripts/crawlora.sh to documented /nike endpoints, remove non-Nike examples, and validate or remove CRAWLORA_API_BASE before this is treated as a tightly scoped Nike-only skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The helper exposes a generic Crawlora client with arbitrary path selection and examples for unrelated services such as Amazon, YouTube, and Google, which materially exceeds the Nike-only scope declared in the skill manifest. In an agent setting, this creates a capability mismatch that can be abused to access unintended third-party data sources or perform broader web research than users and reviewers expect.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The request logic accepts arbitrary paths, methods, query parameters, and JSON bodies, effectively turning the skill into a general-purpose external API proxy rather than a bounded Nike research tool. While not code execution, this unrestricted outbound access widens the data-access surface and can enable policy bypass, unintended scraping targets, or transmission of user-supplied content to external endpoints.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The inline comments advertise broad non-Nike use cases, signaling that the author intended or at least enabled generic Crawlora access despite the manifest claiming a Nike-specific skill. In a security review, this discrepancy increases risk because it suggests hidden or undocumented capability that an agent could invoke outside expected scope.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The document explicitly instructs use of an external API endpoint with an API key header but gives no privacy or disclosure guidance about sending user-supplied search terms, product interests, or location data to a third-party service. In this skill context, that omission is more concerning because store lookup uses precise coordinates and all requests leave the local environment.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The script sends query strings and POST bodies to an external API without any built-in notice, consent gate, or filtering of sensitive content. In an agent environment, users may assume they are querying Nike data indirectly, not transmitting their full prompts, product interests, or other supplied content to Crawlora.

External Transmission

Medium
Category
Data Exfiltration
Content
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**9 endpoints across 1 platform group(s).**
Confidence
87% confidence
Finding
This skill is designed around transmitting data to https://api.crawlora.net, so external transmission is inherent to its operation rather than covert exfiltration. However, it is still a real security/privacy concern because user inputs—including potentially sensitive shopping interests and exact lat/lng for store searches—are sent to a third-party API, and the document does not pair that behavior with safeguards or minimization guidance.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
90% confidence
Finding
This POST branch transmits caller-provided JSON bodies to Crawlora, which is an actual external data flow. In the context of a Nike research skill, this is more sensitive because the helper is generic and may forward arbitrary user-derived content to a third party without strong scoping or disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
set -euo pipefail

: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"

method="GET"
body=""
Confidence
88% confidence
Finding
The base URL is configurable via the CRAWLORA_API_BASE environment variable, allowing requests to be redirected to an arbitrary host while still attaching the x-api-key header. If an attacker or unsafe runtime controls environment variables, this could leak the Crawlora API key or send request data to an unintended endpoint.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:23