ClawHub
Back to skill

Security audit

ecommerce-carbon-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its ecommerce cost and carbon-analysis purpose, but it can send conversation and database-derived results to an external AI service without clear user-facing disclosure.

Review this before installing if you would use it with real ecommerce data. It should clearly disclose the SiliconFlow endpoint, require approval before backend/database access, and document what product, inventory, cost, logistics, and conversation data may leave the local environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill appears to use sensitive capabilities (environment access and MCP connectivity) without declaring corresponding permissions or providing any reviewable documentation in SKILL.md. This creates a transparency and governance gap: a reviewer or runtime may underestimate the skill’s access to secrets and external/data-plane systems, which is especially risky for a database-connected ecommerce analyzer that could read credentials from env and query or exfiltrate business data over MCP.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The auto-activation criteria are broad keyword and intent matches for tasks involving shipping, BOM, cost, and carbon calculations, which can cause the skill to run in situations where the user did not clearly consent to database-backed, multi-step tool use. In this skill’s context, that increases the chance of unnecessary MCP/database queries and unintended retrieval of inventory, cost, or logistics data during ordinary conversation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description says the skill connects to ecommerce databases via MCP and performs multi-round reasoning, but it does not warn that using the skill may trigger automatic tool calls and data retrieval across product, BOM, warehouse, cost, and logistics records. This lack of transparency can bypass meaningful user awareness and consent, especially because multi-step agent behavior may aggregate sensitive commercial data beyond what the user expects from a simple calculation request.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code automatically sends the conversation history, including user input and subsequent tool outputs, to a remote LLM service without any notice, consent gate, or data-minimization step. In this skill context, tool outputs may contain sensitive ecommerce, inventory, cost, or logistics data, so silent transmission to a third-party model endpoint creates a real confidentiality and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
# 2. 初始化 LLM 客户端
            llm_client = OpenAI(
                api_key=os.getenv('SILICONFLOW_API_KEY'),
                base_url="https://api.siliconflow.cn/v1",
            )

            messages = [
Confidence
90% confidence
Finding
The client is explicitly configured to use a remote API endpoint at api.siliconflow.cn, which means prompts and potentially tool-derived business data leave the local environment. By itself, using a remote endpoint is not malicious, but in a database-connected ecommerce analysis skill it increases the chance of exposing commercially sensitive or regulated data to an external processor.

Static analysis

No suspicious patterns detected.