ClawHub
Back to skill

Security audit

zalando-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a Zalando research helper, but its bundled script can call arbitrary Crawlora endpoints and send arbitrary request bodies beyond the advertised Zalando-only scope.

Install only if you are comfortable giving the agent a Crawlora API key and a helper that can be manually used beyond Zalando. Prefer restricting or editing scripts/crawlora.sh to allow only /zalando/markets, /zalando/search, /zalando/suggest, /zalando/product, and /zalando/category before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill explicitly instructs use of shell commands (`scripts/crawlora.sh`, `curl`) but does not declare any permissions for shell execution. That creates a capability/permission gap: a caller or platform reviewer may believe the skill is constrained to harmless research behavior when it can invoke command execution and network access through the shell.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The helper advertises and supports generic Crawlora endpoints such as Amazon, YouTube, and Google even though the skill is described as Zalando-only research. This creates capability drift: a caller can use the skill as a general third-party data exfiltration or web-research proxy beyond its declared scope, weakening least-privilege boundaries and policy enforcement.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The code directly concatenates an arbitrary caller-supplied path onto the API base and sends it with the API key, allowing invocation of any Crawlora endpoint the key can access. In a skill intended only for Zalando storefront research, this broad proxy behavior can be abused to perform unrelated data access or external calls under the agent's credentials.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The usage examples expose capabilities for Google, Amazon, and YouTube research that are unrelated to the skill's stated Zalando storefront purpose. This mismatch makes it easier for downstream agents or users to repurpose the skill for unintended cross-domain research, bypassing expectations and governance based on the metadata.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
81% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:23