ClawHub
Back to skill

Security audit

shop-app-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Shop.app research integration, but its bundled helper can use the Crawlora API much more broadly than the Shop.app-only purpose suggests.

Review before installing. Use this skill only if you are comfortable sending Shop.app search terms, shop handles, product IDs, and related identifiers to Crawlora with your API key. The Shop.app instructions are coherent, but the included helper is a general Crawlora API caller, so agents or users should restrict calls to the documented /shop-app endpoints and avoid sending secrets or personal data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The helper is explicitly documented and implemented as a generic Crawlora client that can call arbitrary API paths, including endpoints unrelated to Shop.app research. In a skill whose stated purpose is narrowly scoped to Shop.app data, this broad capability violates least privilege and can be abused to access other data sources or services through the same authenticated channel.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The runtime logic forwards any caller-supplied path, method, query parameters, and JSON body directly to Crawlora with the configured API key, creating unrestricted authenticated cross-service access. Because the skill is supposed to be Shop.app-only, this makes the actual privilege envelope far broader than users or integrators would expect and could enable unauthorized data retrieval or misuse of paid API capabilities.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The file explicitly instructs the agent to send user-supplied queries, shop handles, product IDs, and related identifiers to an external third-party API using an authenticated request, but it does not warn about data disclosure or constrain what may be sent. In an agent setting, this creates a real privacy and data-handling risk because users may provide sensitive shopping interests or identifiers that are then silently transmitted off-platform.

External Transmission

Medium
Category
Data Exfiltration
Content
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).

All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.

**16 endpoints across 1 platform group(s).**
Confidence
92% confidence
Finding
https://api.crawlora.net/

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
84% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:25