ClawHub
Back to skill

Security audit

Amazon Review Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses a Reveyes API key to fetch Amazon review data and asks the agent to analyze it, with some ordinary privacy and dependency cautions.

Install only if you are comfortable sending requested ASIN/review-fetch parameters to Reveyes and using a Reveyes API key. Keep the API key out of shared logs, screenshots, repositories, and synced dotfiles where possible; prefer a scoped secret store or rotate the key if exposed. Treat exported raw reviews as data to minimize and share carefully, especially fields like reviewer names and profile URLs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:10
Finding

Unpinned Third-Party SDK Creates a Mutable Supply-Chain Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: clawhub.json:10-12, README.md:18-25, scripts/fetch.py:13-19
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Evidence

clawhub.json:10-12 permits any current or future package release at or above version 0.1.3:

json
"requires": {
  "env": ["REVEYES_API_KEY"],
  "pip": ["reveyes>=0.1.3"]
},

README.md:18-25 installs both the project and SDK from mutable sources:

bash
git clone https://github.com/zhuojiuya/Amazon-Review.git
cp -r Amazon-Review/reveyes-skill ~/.openclaw/workspace/skills/amazon-review-reveyes
bash
pip install reveyes

scripts/fetch.py:13-19 imports and therefore executes the installed SDK:

python
try:
    from reveyes import ReveyesClient
    from reveyes.exceptions import (
        AuthenticationError,
        BadParamsError,
        InsufficientCreditsError,
    )

Technical Analysis

The dependency is necessary for the Skill's declared review-retrieval functionality, and there is no evidence that the currently intended package is malicious. However, neither the installation instructions nor the Skill metadata pin the package to an exact audited version or verify its distribution hash.

The constraint reveyes>=0.1.3 accepts future releases that were not part of this audit. Similarly, pip install reveyes resolves the latest compatible package at installation time, while the Git clone command uses the repository's mutable default branch.

Python modules can execute arbitrary code during import. The SDK is imported inside the Agent process before the helper performs its own credential checks. Consequently, a compromised future SDK release could run with the process's file-system permissions and access all environment variables available to that process, not only the required REVEYES_API_KEY.

This exceeds the minimum trust boundary required for th ...[truncated 1342 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the open-ended dependency constraint with an exact, reviewed version, such as:

    json
    "pip": ["reveyes==0.1.3"]

  2. Maintain a lock file containing cryptographic hashes and install with hash verification, for example using pip --require-hashes.

  3. Pin manual installation to a verified release tag or immutable commit rather than the repository's default branch.

  4. Verify release signatures or hashes before installation.

  5. Run the helper in an isolated environment containing only the required REVEYES_API_KEY, rather than exposing the Agent's complete environment.

  6. Restrict outbound network access to the documented Reveyes API hostname where the execution platform supports egress controls.

  7. Review dependency updates before changing the pinned version and use automated software-composition analysis to monitor known vulnerabilities.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/fetch.py:26
Finding

User-Controlled Metered API Parameters Are Not Validated Locally

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch.py:26-29, scripts/fetch.py:48-54
Vulnerability Type: Missing input validation for externally billed API requests
Risk Level: Low

Evidence

scripts/fetch.py:26-29 accepts command-line values without validating the documented ASIN format, marketplace allowlist, page limit, or filter allowlist:

python
asin        = sys.argv[1] if len(sys.argv) > 1 else None
marketplace = sys.argv[2] if len(sys.argv) > 2 else "US"
pages       = int(sys.argv[3]) if len(sys.argv) > 3 else 2
filter_star = sys.argv[4] if len(sys.argv) > 4 else "all_stars"

scripts/fetch.py:48-54 sends those values to the metered external service unchanged:

python
try:
    task = client.fetch_reviews([{
        "asin": asin,
        "marketplace": marketplace,
        "pages": pages,
        "filter_star": filter_star,
        "filter_sort_by": "recent",
    }])

The Skill documentation states that an ASIN must contain 10 alphanumeric characters and that pages must be between 1 and 10, but the executable does not enforce either constraint.

Technical Analysis

User-derived parameters cross a network and billing boundary without local validation. The helper only checks whether an ASIN value is present. It does not verify:

  • That the ASIN contains exactly 10 permitted alphanumeric characters.
  • That pages is between 1 and 10.
  • That the marketplace is one of the 20 documented values.
  • That the review filter is one of the supported values.

There is no shell interpolation in this code, so the observed behavior does not establish command injection. The principal security concern is uncontrolled use of a metered external API. If the remote service does not independently enforce equivalent limits, an oversized page count could consume more credits or resources than the Skill's documented maximum.

In addition, int(sys.argv[3]) is ev ...[truncated 1329 chars]

Remediation
View remediation

Remediation Suggestions

  1. Validate ASINs before creating a task:

    python
    import re

if not re.fullmatch(r"[A-Z0-9]{10}", asin.upper()):
    fail("ASIN must contain exactly 10 alphanumeric characters", "BAD_PARAMS")

  2. Parse and constrain page counts with structured error handling:

    python
    try:
    pages = int(sys.argv[3]) if len(sys.argv) > 3 else 2
except ValueError:
    fail("pages must be an integer", "BAD_PARAMS")

if not 1 <= pages <= 10:
    fail("pages must be between 1 and 10", "BAD_PARAMS")

  3. Enforce explicit allowlists for marketplaces and star filters before making a network request.

  4. Return a consistent JSON BAD_PARAMS response for all locally rejected values.

  5. Consider presenting the estimated credit cost and requiring confirmation before relatively large requests.

  6. Retain server-side validation as a second layer; local validation should not be treated as a replacement for API-side authorization, quotas, and billing limits.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

该代码的核心行为与声明存在明显功能落差。抓取评论并输出完整字段这部分与声明基本一致，且确实调用了 Reveyes API、返回全量评论和低分评论，并附带一些基础统计。但声明中的关键价值点是“由 AI 深度分析差评并提供结构化分析报告”，代码完全没有任何模型调用、文本分析、主题提取、情感归因、优先级排序或报告生成逻辑，因此这是实质性缺失。此外，声明写的是“批量抓取”，而脚本命令行接口只接受一个 asin 并向 API 发送单元素列表，不构成真正的批量输入支持。至于“支持 20 个站点”，代码虽然有 marketplace 参数，但没有展示多站点能力实现细节；这一点本身不如 AI 分析缺失严重，但也比声明弱。综合判断，描述高估了实际能力，属于不匹配。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README instructs users to place a live API key in shell startup files or a persistent config file but gives no warning about file permissions, secret leakage, or safer secret-management options. This can cause long-lived credential exposure through shared dotfiles, backups, screenshots, shell history, or multi-user systems, enabling unauthorized use of the Reveyes account.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Persisting the API key in ~/.zshrc or ~/.bashrc creates a long-lived secret that is automatically loaded into future shells and may be exposed through dotfile syncing, local compromise, support bundles, or accidental sharing. For a third-party review-scraping service, unauthorized access can consume credits, expose account metadata, and facilitate continued misuse until the key is rotated.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Get your key free at www.reveyes.cn → Dashboard → API Keys.

bash
# Add to ~/.zshrc or ~/.bashrc
export REVEYES_API_KEY="your_api_key_here"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README tells users to invoke the skill through unconstrained natural language without clearly defining trigger boundaries, required parameter structure, or exclusion conditions. In an agent ecosystem, this increases the chance of accidental over-invocation, parameter confusion, or prompt-trigger collisions with unrelated requests, which can lead to unintended external API calls and unnecessary data exposure or spend.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill declares access to sensitive execution capability via environment variables but does not constrain tool usage with an explicit permissions or allowed-tools policy. In an agent setting, missing scope boundaries increases the chance that the runtime can invoke broader capabilities than intended, especially when the skill also instructs execution of a Python script and external API access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to display complete scraped review data, including reviewer nicknames, profile URLs, and quoted original text, without minimization or warning. This can expose personal or quasi-identifying information unnecessarily, amplify scraped data beyond original context, and create privacy/compliance risk when outputs are shared or stored.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The instruction to disclose complete raw review payloads and verbatim quoted text causes unnecessary data exposure in model outputs. Even if the source is publicly accessible, reproducing all returned fields at scale can increase privacy, retention, and policy risk, especially when the agent is asked to structure and highlight individual users' content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code performs network calls to the Reveyes service using the provided ASIN and then fetches complete review records, including fields such as user_name and profile_url. While the script's purpose is to fetch reviews, the file itself does not include any explicit user-facing warning, logging, or comment disclosing that external API transmission and third-party data retrieval will occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Several user-facing error strings are hard-coded in Chinese, while other messages in the same script are in English. This imposes a specific language on users without opt-in or justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Language-policy issues apply to all file types. The text implies users should 'talk naturally,' yet all examples are in Chinese and there is no statement that other languages are supported or that Chinese is a required locale, which can amount to an implicit language constraint without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest declares REVEYES_API_KEY as a required environment variable, which is a sensitive credential. The markdown provides operational guidance but does not include any user-facing warning not to expose, print, or share the API key during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.