ClawHub
Back to skill

Security audit

AI电商专家｜品牌电商视觉一致性

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its ecommerce purpose, but it runs external software in a way that can expose more local secrets than it needs.

Review this skill before installing. Use it only in an environment that does not contain unrelated cloud, CI, database, or API secrets; prefer a pinned version of the npm package; and confirm that the IMIVA token is scoped and revocable. The skill is not judged malicious, but its current subprocess and environment handling are broader than necessary.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
88% confidence
Finding
The script spawns an external process that executes a package fetched via `npx`, which materially expands the trust boundary from local Python code to remotely distributed Node.js code. Because the package reference uses `@latest`, the exact code executed can change over time, so a compromised upstream package or malicious update would run with access to the provided environment and stdio channels.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes shell commands, reads environment variables, and accesses local files, but does not declare those capabilities or permissions. That creates a transparency and consent gap: a host or reviewer may treat the skill as documentation-only while it can actually access sensitive local paths and tokens such as MCP_TOKEN during setup and execution.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The CLI launches code through `npx` without an explicit warning, confirmation, or other user-facing indication that it will execute an external package. This is risky because users may assume they are running only local helper logic, while in reality the command may download and run package code from the Node ecosystem.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code forwards `MCP_TOKEN` into the child process environment without prominent disclosure or containment. Any compromise of the spawned package, its dependencies, or subprocess descendants would expose a live authentication secret that could be used to access the IMIVA MCP service.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
90% confidence
Finding
Copying the entire parent environment into a child process unnecessarily exposes all inherited secrets and configuration to externally executed package code. In this skill context, that is more dangerous because the helper is specifically designed to broker access to a third-party MCP tool via dynamic package execution, so unrelated CI/CD, cloud, or API credentials present in the environment may also leak if the child code is compromised.

Static analysis

No suspicious patterns detected.