ClawHub
Back to skill

Security audit

AI电商专家｜电商 AIGC 营销内容

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its ecommerce-content purpose, but it should be reviewed because its helper runs an unpinned external npm package while forwarding the full local environment.

Install only if you trust the IMIVA npm package and are comfortable sending product assets and task data to IMIVA under your token. Prefer pinning the npm package version, running it in a clean environment without unrelated secrets, and changing the helper to pass only the required environment variables before operational use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
91% confidence
Finding
The script launches an external package via `npx` at runtime, which can fetch and execute the latest published code for `@infimind/ecom-content-cli@latest` on the host. Even though `shell=True` is not used, this still creates a supply-chain and arbitrary code execution risk because the package version is unpinned and runs with inherited environment variables, including the MCP token.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documents use of environment variables, local file paths, and shell commands, but it does not declare corresponding permissions or capability boundaries. This can mislead users and hosting agents about the skill's access requirements, increasing the chance of unintended file access, token exposure, or unsafe command execution in environments that rely on manifest permissions for trust decisions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This file silently uses `npx -y` to install and run an external package without any confirmation, which means users may trigger network retrieval and execution of third-party code without realizing it. In a skill context, that is especially risky because the helper is positioned as automation glue and may be run in trusted enterprise environments with secrets available.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
93% confidence
Finding
Copying the entire parent environment into a child process that executes externally sourced code unnecessarily exposes all ambient secrets and configuration to that process. In this script, the risk is amplified because the child is an `npx`-launched package fetched at runtime, so any compromised package or dependency could read and exfiltrate unrelated credentials from the inherited environment.

Static analysis

No suspicious patterns detected.