ClawHub
Back to skill

Security audit

Amazon Scraper

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Amazon scraping skill, but it needs Review because it uses an Apify API key and third-party scraping with weak disclosure and insecure setup guidance.

Install only if you are comfortable sending Amazon search terms and scraping activity to Apify. Use an isolated virtual environment, keep the Apify token in an environment variable or secret manager, avoid hardcoding it, do not use the cron example unless you really want scheduled scraping, and treat generated spreadsheets as untrusted external-content reports.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
amazon_scraper.py:86
Finding

API Credential Exposed Through URL Query Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
amazon_scraper.py:235
Finding

Spreadsheet Formula Injection Through Scraped Product Data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:116
Finding

Documentation Encourages Hardcoding an API Credential in Source Code

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned Dependencies Installed by Bypassing System Package Protections

Content
View full analysis
=3.0.0 requests>=2.28.0 ``` The installation instructions in `README.md:14`, `SKILL.md:34`, and `USAGE.md:8` use: ```bash pip3 install -r requirements.txt --break-system-packages ``` ### Technical Analysis The dependency constraints specify only minimum versions and have no upper bounds, exact pins, integrity hashes, or lock file. A future installation may therefore resolve to package versions that were never reviewed with this Skill. This creates non-reproducible builds and increases exposure to future dependency compromise or incompatible releases. The documentation compounds this risk by recommending `--break-system-packages`, which bypasses Python distribution safeguards and permits packages to be installed into a system-managed environment. This is unnecessary for the Skill's declared functionality because it can run in an isolated virtual environment without modifying the host Python installation. No typosquatted or overtly malicious package was identified: `openpyxl` and `requests` are established packages. The risk arises from version resolution and installation scope rather than a confirmed malicious dependency. ### Attack Path 1. A user follows the documented system-wide installation command. 2. Package resolution selects the latest versions satisfying the open-ended constraints. 3. A future compromised, vulnerable, or incompatible release is selected. 4. Installation changes the system-managed Python environment. 5. Package code executes during import when the Skill runs. 6. A compromised dependency would execute with the privileges of the user running the Skill; incompatible packages could also disrupt unrelated system Python applications. ### Impact Assessment A malicious dependency release could exe ...[truncated 511 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (26)

Tainted flow: 'params' from os.getenv (line 87, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · amazon_scraper.py (reported line 99)May include surrounding context.

python
try:
        # 启动爬取任务
        response = requests.post(apify_url, params=params, json=payload)
        run_data = response.json()
        
        if "error" in run_data:

Tainted flow: 'params' from os.getenv (line 87, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · amazon_scraper.py (reported line 119)May include surrounding context.

python
# 检查状态
            status_url = f"https://api.apify.com/v2/actor-runs/{run_id}"
            status_response = requests.get(status_url, params=params)
            status_data = status_response.json()
            
            status = status_data["data"]["status"]

Tainted flow: 'params' from os.getenv (line 87, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · amazon_scraper.py (reported line 134)May include surrounding context.

python
# 获取数据
        dataset_url = f"https://api.apify.com/v2/datasets/{dataset_id}/items"
        data_response = requests.get(dataset_url, params=params)
        data = data_response.json()
        
        print(f"📦 获取到 {len(data)} 条原始数据")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language instructions and headings are entirely in Chinese, and the document does not indicate that this is a region-specific skill or offer an alternative language option. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation does not clearly warn users that search queries and scraping targets may be sent to Apify, a third-party service. In an agent context, this can lead to unintentional disclosure of potentially sensitive research terms, business intelligence queries, or user-provided data to an external processor without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The invocation examples use very broad natural-language triggers such as asking to scrape Amazon data, without defining explicit activation boundaries or requiring confirmation. In an agent setting, broad triggers can cause accidental invocation, unexpected third-party requests, or data processing based on ambiguous user prompts, especially for a skill that performs scraping and external API use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file documents '深度爬取（价格/评分/销量）' as a supported advanced feature and even shows a command-line invocation at L158-L169, while the changelog TODO at L246-L248 says that same feature is not yet implemented. This is an active contradiction in the skill's own documentation about current behavior and capabilities.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

L172-L182 describes '定时监控' as an advanced function with a concrete cron example and stated use cases, implying present support. However, L246-L250 lists '定时监控告警' as still TODO, which contradicts the earlier presentation of monitoring capability as available.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide tells users to obtain and configure an Apify API key, but it does not clearly disclose that search keywords and scraping activity will be sent to a third-party service. This is a real transparency and privacy issue because users may unknowingly expose business interests, research targets, or usage metadata to Apify.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · USAGE.md (reported line 153)May include surrounding context.

配置 cron 每天执行：

bash
# 编辑 crontab
crontab -e

# 添加（每天凌晨 3 点执行）
0 3 * * * cd /path/to/amazon-scraper && python3 amazon_scraper.py

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file-level description and all user-facing messages are written exclusively in Chinese, indicating the skill is designed to operate in a fixed language. There is no option for users to choose a language or any documentation justifying a mandatory Chinese locale, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code sends search keywords and target URLs to the external Apify service via HTTP requests, but there is no explicit user warning that input data and scraped context will be transmitted to a third-party platform. Although progress is printed, those messages do not disclose the privacy or external-sharing aspect of the operation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · amazon_scraper.py (reported line 86)May include surrounding context.

python
# 启动 Apify Actor
    start_url = f"https://www.amazon.com/s?k={keywords[0].replace(' ', '+')}"
    
    apify_url = "https://api.apify.com/v2/acts/apify~web-scraper/runs"
    params = {
        "token": APIFY_TOKEN
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · amazon_scraper.py (reported line 118)May include surrounding context.

python
# 启动 Apify Actor
    start_url = f"https://www.amazon.com/s?k={keywords[0].replace(' ', '+')}"
    
    apify_url = "https://api.apify.com/v2/acts/apify~web-scraper/runs"
    params = {
        "token": APIFY_TOKEN
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · amazon_scraper.py (reported line 133)May include surrounding context.

python
# 启动 Apify Actor
    start_url = f"https://www.amazon.com/s?k={keywords[0].replace(' ', '+')}"
    
    apify_url = "https://api.apify.com/v2/acts/apify~web-scraper/runs"
    params = {
        "token": APIFY_TOKEN
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · amazon_scraper.py (reported line 99)May include surrounding context.

python
try:
        # 启动爬取任务
        response = requests.post(apify_url, params=params, json=payload)
        run_data = response.json()
        
        if "error" in run_data:

Tainted flow: 'status_url' from requests.post (line 118, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · amazon_scraper.py (reported line 119)May include surrounding context.

python
# 检查状态
            status_url = f"https://api.apify.com/v2/actor-runs/{run_id}"
            status_response = requests.get(status_url, params=params)
            status_data = status_response.json()
            
            status = status_data["data"]["status"]

Tainted flow: 'dataset_url' from requests.post (line 133, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · amazon_scraper.py (reported line 134)May include surrounding context.

python
# 获取数据
        dataset_url = f"https://api.apify.com/v2/datasets/{dataset_id}/items"
        data_response = requests.get(dataset_url, params=params)
        data = data_response.json()
        
        print(f"📦 获取到 {len(data)} 条原始数据")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring for generate_report says it returns a整理后的商品列表, but the implementation ends with return unique_products[:max_products] even though max_products is not defined in the function scope. In practice this causes a runtime failure rather than returning the documented processed list, so the documented intent and actual code behavior diverge in a meaningful way.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file states that the skill scrapes Amazon product data and generates structured reports, including amazon-data.xlsx and amazon-report.md, but it does not warn users that running the skill will write files to the local filesystem. For markdown files, omissions around behaviors that affect user data or system state can warrant a missing-warning finding.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill's natural-language instructions and usage guidance are entirely in Chinese, and the file does not state that the skill is intended only for Chinese-speaking users or provide an opt-in language choice. This creates a locale/language policy concern because it effectively forces one language without documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The file forces a single language for all instructions and examples, with no opt-in, alternate language, or justification for a locale-specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time and can inadvertently install a vulnerable or untested release. For a security-sensitive supply chain, lack of pinning reduces reproducibility and makes it difficult to verify whether known vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
openpyxl>=3.0.0
requests>=2.28.0

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

openpyxl has known historical advisories, and because the manifest does not pin a version, it is impossible to determine from this file whether deployments will use an affected release. The main danger is uncertainty in dependency hygiene: an environment resolver could select a vulnerable version if constraints elsewhere permit it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

Using an unpinned requests dependency means future installs can pull in different versions, including versions later found vulnerable or behaviorally incompatible. This weakens supply-chain control and complicates auditing and incident response.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
openpyxl>=3.0.0
requests>=2.28.0