Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Skill Dropshipping Product Launcher
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill’s behavior matches its stated purpose, but it does require real CJ Dropshipping and WooCommerce credentials and can create persistent draft products, media, categories, and token updates.
This looks like a purpose-aligned dropshipping automation skill rather than malicious code. Before installing, make sure you are comfortable giving it CJ and WooCommerce API credentials, run with `--dry-run` first, verify the configured WooCommerce store URL, and use limited-scope credentials where possible.
Static analysis
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Env credential access
Critical
- Finding
- Environment variable access combined with network send.
Exposed secret literal
Critical
- Finding
- File appears to expose a hardcoded API secret or token.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
Installing and using the skill means trusting it with store/API credentials capable of creating WooCommerce content.
Why it was flagged
The skill requires API credentials for two services. This is expected for its purpose, but those credentials can access CJ product data and mutate a WooCommerce store.
Skill content
**CJ API**: `~/cj-api.json` — fields: `apiKey`, `accessToken`, `tokenExpiry` - **WooCommerce**: `~/woo-api.json` — fields: `url`, `consumerKey`, `consumerSecret`
Recommendation
Use least-privilege WooCommerce keys, keep the JSON files protected, and review the configured store URL before running.
What this means
Running without `--dry-run` can create persistent products, media uploads, categories, and variations in the configured WooCommerce store.
Why it was flagged
The normal workflow posts to the WooCommerce products API. This matches the stated product-launcher purpose and defaults products to draft, but it is still a real account mutation.
Skill content
const res = await axios.post(`${config.url}/wp-json/wc/v3/products`, body, {
auth: wooAuth(config),
});Recommendation
Run `--dry-run` first, confirm the product ID, price, category, and target store, and delete unwanted drafts/media if needed.
What this means
The local CJ credential file will be updated with a refreshed token during use.
Why it was flagged
The CJ access token is refreshed and written back to the local credential file. SKILL.md discloses automatic token refresh, so this is purpose-aligned persistence of credential state.
Skill content
fs.writeFileSync(CJ_CONFIG_PATH, JSON.stringify(updated, null, 2));
Recommendation
Store `~/cj-api.json` with restrictive file permissions and avoid pointing `CJ_API_PATH` at shared or sensitive unrelated files.
What this means
Dependency installation introduces standard third-party package risk.
Why it was flagged
The skill depends on npm packages for HTTP and multipart upload. This is normal for the stated functionality, and a package-lock is included, but users still rely on npm package provenance.
Skill content
npm install axios form-data
Recommendation
Install from the skill root so the lockfile is used, and review dependency updates before use in a production store environment.