cross-border-intel

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

The skill matches its market-intelligence purpose, but it forwards a privileged OpenClaw gateway token to an external configurable API and exposes broad helper functions beyond the user-facing commands.

Review before installing. This skill stores competitive-intelligence data locally and contacts a backend service for Amazon and TikTok data. The main risk is credential handling: it reuses the OpenClaw gateway token for an external, configurable API instead of a narrowly scoped service token. Install only if you trust the publisher and backend, can constrain INTEL_API_URL, and are comfortable with local retention of watchlists, snapshots, alerts, reports, and raw provider data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: dist/core/config.js:40

Finding

OpenClaw Gateway Credential Transmitted to an External, Configurable API

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A description that claims benign market-intelligence functions while the analyzed implementation reportedly includes generic SQL execution and configuration storage is a meaningful security concern. Hidden or under-declared arbitrary query capability expands the attack surface and can enable unauthorized data access or destructive database actions if exposed through commands or agent workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the skill sends Amazon product identifiers and TikTok search keywords to backend API endpoints, but it does not clearly warn users that their monitored product interests and search terms are transmitted to an external service. This creates a privacy and data-governance risk because commercially sensitive monitoring targets may be exposed off-device without informed user consent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises automated monitoring of Amazon and TikTok data and explicitly requires curl/python3/jq, which implies network-capable behavior, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization/transparency gap: users and the platform cannot easily verify what external access the skill is allowed to perform or constrain it to only the intended targets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill promises continuous scheduled scanning, alerting, and report generation against external platforms but does not clearly warn users that it will perform ongoing network access and external data collection. In an agent setting, this lack of notice and consent can lead to unexpected background activity, privacy surprises, or policy violations, especially because the monitoring is persistent and automated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This function performs an external fetch via fetchAmazonProduct and persists the retrieved product data and alerts to the database, but there is no confirmation prompt, visible logging/print statement, or inline warning describing these side effects. For a code-file audit under SQP-2, these are safety-relevant operations because they transmit/query external data and write local state without any user-facing disclosure in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The scan result returns process.env.INTEL_DB_PATH to the caller even though the function's stated purpose is product scanning and alert generation. Exposing internal filesystem paths leaks deployment details that can aid attackers in environment reconnaissance, targeted file access attempts, or chaining with other weaknesses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code constructs authenticated HTTP requests using a bearer token and sends JSON bodies to backend endpoints, which may include user-provided data such as ASINs or search keywords. While the file has developer comments, it contains no user-facing confirmation, logging, or warning that data and credentials are being transmitted over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is written entirely in Chinese, which indicates a language-specific presentation without any visible opt-in or alternative locale. Under the policy rule, forcing or assuming a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains a natural-language instruction requiring reports to be written in Chinese: "用中文撰写." The policy allows locale constraints only when the user is given a choice or the restriction is clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code serializes and stores the full TikTok video object in rawData without any minimization, retention control, or indication of notice/consent handling. Because this skill is explicitly designed for competitive intelligence and trend monitoring, the stored payload may include more metadata than is needed for alerting, increasing privacy, compliance, and breach exposure if the database is later accessed or leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The code exposes a deletion operation that irreversibly removes a watchlist item from the database, but there is no confirmation prompt, user-facing log, or explicit warning in the function body or surrounding comments. Because this is a destructive action, the lack of any disclosure increases the risk of accidental data loss when the skill invokes it.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/architecture.md (reported line 82)May include surrounding context.

md

2. fetch provider data from backend capability endpoints
3. store raw and normalized observations locally
4. compare new and previous observations
5. create alerts locally
6. generate reports locally
7. schedule the next run locally
8. answer chat questions from local state

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README documents local SQLite storage of watchlists, snapshots, alerts, and reports, but it does not warn users that potentially sensitive business intelligence data will be retained on disk. On shared systems or poorly secured endpoints, this retained data could be accessed by other users or malware, exposing competitive research and operational history.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Natural-language policy issues apply to all file types, including markdown. Here, the skill name and all user-facing instructions are presented only in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The test requires the skill description to contain the Chinese term '跨境', which hard-codes a locale/language expectation into the skill metadata. In this file there is no indication that users are offered a language choice or that the locale restriction is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file contains user-facing instructions only in Chinese, starting from the title and continuing throughout the testing guide. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"clean": "rm -rf dist"
    },
    "dependencies": {
        "sql.js": "^1.12.0"
    },
    "devDependencies": {
        "@types/node": "^22.10.5",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

"sql.js": "^1.12.0"
    },
    "devDependencies": {
        "@types/node": "^22.10.5",
        "@types/sql.js": "^1.4.4",
        "typescript": "^6.0.2"
    }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json

},
    "devDependencies": {
        "@types/node": "^22.10.5",
        "@types/sql.js": "^1.4.4",
        "typescript": "^6.0.2"
    }
}

Static analysis

No suspicious patterns detected.