ClawHub
Back to skill

Security audit

Amazon Listing 图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Amazon listing image-generation helper that uses a fixed external AI service, with expected local image upload and API-key storage behavior.

Before installing, make sure you are comfortable sending listing prompts and any provided product images to AI Hive. Use a dedicated API key if possible, review generated images against Amazon policy and your real ASIN/SKU facts, and avoid passing confidential product material unless the AI Hive service is approved for that data.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill demonstrates operational capabilities including shell execution, file access, environment access, and network use, but it does not declare permissions or clearly scope those capabilities. This creates a trust and review gap: users or hosting systems may not realize the skill can read local inputs, write files, invoke commands, or contact an external API, which increases the risk of unintended data exposure or misuse if the wrapper script changes or is abused.

Static analysis

No suspicious patterns detected.