ClawHub
Back to skill

Security audit

AI电商专家｜AliExpress 速卖通 图片视频全内容

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its ecommerce-content purpose, but it needs review because it runs a mutable npm package and passes the user's full environment to it.

Review before installing. Use a dedicated environment with only the IMIVA token and required variables, avoid running it from a shell containing other secrets, and prefer a pinned package version or reviewed MCP client configuration over `@latest`.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
84% confidence
Finding
The script launches `npx -y @infimind/ecom-content-cli@latest`, which executes code fetched at runtime and tracks the mutable `latest` tag. This creates a supply-chain and trust-boundary risk: if the package or a dependency is compromised, or if the registry response is tampered with, the process will run attacker-controlled code with access to the inherited environment, including `MCP_TOKEN`.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the host to use shell commands, read local files via paths like /path/to/product.jpg, and consume secrets from environment variables such as MCP_TOKEN, but it does not declare permissions for those capabilities. This creates a trust and review gap: a user or platform may treat the skill as lower risk than it is, even though it can access local resources and invoke external tooling that may expose sensitive data or perform unintended actions.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
88% confidence
Finding
Copying the entire parent environment into a child process broadens secret exposure unnecessarily. In this skill, that child process is an externally sourced `npx` package, so all inherited environment variables—not just `MCP_TOKEN`—may become accessible to third-party code if the package is compromised or behaves unexpectedly.

Static analysis

No suspicious patterns detected.