ClawHub
Back to skill

Security audit

AI电商专家｜Amazon A+ 页面 图片视频全内容

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for IMIVA ecommerce content generation, but it asks users to run an unpinned npm MCP package with a token and passes the full local environment to that process.

Review before installing. Use this only if you trust the IMIVA npm package and are comfortable sending product assets and task details to the IMIVA service. Prefer running it in a clean shell or restricted environment containing only the needed MCP_TOKEN, API_URL or IMIVA_API_URL, PATH, and basic locale variables; avoid exposing unrelated cloud, database, or personal tokens. Confirm credit costs before creating image or video tasks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use shell commands, read environment variables, and access local files, but it does not declare permissions or narrowly constrain when those capabilities should be used. This creates a mismatch between apparent trust boundaries and actual behavior, increasing the risk of unintended local file access, token exposure, or command execution in clients that rely on permission declarations for enforcement or user review.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The invocation description is very broad and covers generic ecommerce content, listing, social commerce, and creative workflows, which can cause the skill to be selected in contexts beyond its narrowly intended Amazon A+ use case. Over-broad routing increases the chance that sensitive business materials, local assets, or credentials are exposed to this skill unnecessarily, especially because it can drive tool usage and local resource handling.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The search coverage section enumerates a very wide set of brands, platforms, models, and commercial intents, effectively optimizing the skill to match many unrelated requests. In context, this makes the skill more dangerous because it increases unsolicited invocation probability for tasks involving third-party assets, marketplace content, or competitive material, despite the skill also enabling local file paths and tool-backed task submission.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
83% confidence
Finding
The code forwards a full copy of the parent process environment to an external `npx`-launched package. In a skill context that executes third-party npm code (`@latest`), this expands the secret exposure boundary to every environment variable present in the host process, so a compromised or malicious package could read and exfiltrate unrelated credentials.

Static analysis

No suspicious patterns detected.