ClawHub
Back to skill

Security audit

Product Opportunity Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Amazon review-analysis purpose, but it needs review because it automatically uses Bright Data, stores review data, and documents unsafe API-key handling.

Review before installing or running. The skill is not showing deception or destructive behavior, but it will use Bright Data to fetch Amazon reviews and may save review data locally. Avoid passing API keys on the command line; use a secret manager, environment variable, or interactive secret prompt instead, and confirm where stored review data is retained or deleted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:26
Finding

Untrusted Review Content Can Manipulate AI Analysis Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:26-49 and SKILL.md:58-103
Vulnerability Type: Indirect prompt injection through attacker-controlled review content
Risk Level: Medium

The Map and Reduce prompts directly incorporate Amazon review content without identifying it as untrusted data or instructing the model to ignore commands embedded in that content.

Relevant code snippet (SKILL.md:26-49):

markdown
将评论数据分批处理，每批30条，使用以下 Prompt 提取痛点：

```markdown
# Role
你是一个电商评论数据标注员。

# Task
阅读以下亚马逊1-3星评论，提取出与【产品本身】相关的痛点和机会。

# Rules
1. 忽略物流、包装、客服问题。
2. 只提取真实存在的缺陷或明确的需求。
3. 必须严格按照JSON数组格式输出，不要输出任何解释性废话。

# Output Format
[
  {
    "tag": "痛点/机会/预期偏差",
    "module": "如：电池/材质/安装/尺寸",
    "point": "简练概括问题（15字以内）",
    "quote": "截取评论中最核心的一句原话"
  }
]

# Input Data
[评论内容]

Relevant code snippet (SKILL.md:58-103):

markdown
# Task
我已经让助手从上千条1-3星评论中提取了结构化的痛点数据。以下是提取出的JSON数组。请你基于这些精炼的数据，输出一份具备高落地性的《产品痛点与机会洞察报告》。

# Analysis Dimensions(分析维度)
在阅读评论时，请用以下几个维度进行过滤和分类：
1. 产品改造点：
   * 材质与做工：异味、掉漆、易碎、手感差等。
   * 功能缺陷：无法正常工作、按键失灵、效率低下等。
   * 设计缺陷：反人类设计、不符合人体工学、安装困难等。
   * 耐用性：用几次就坏、电池衰减快等。
2. 产品机会点：
   * 痛点延伸：客户为了解决该产品的问题，不得不搭配其他东西一起用（发现互补品机会）。
   * 场景错位：客户把产品用在了意想不到的场景，但现有产品不支持（发现细分场景机会）。
   * 缺失功能："要是它能具备XX功能就好了"、"我以为它可以XX"（发现迭代机会）。
3. 预期管理偏差：
   * Listing误导：买家以为是A，收到发现是B（属于优化详情页的机会，而非改产品）。

# Constraints & Rules (规则与约束)
* 禁止关注非产品因素：忽略所有关于FBA物流延迟、包装破损（除非影响产品本身）、客服态度的吐槽。
* 基于事实，拒绝脑补：每一个洞察都必须在输出时附带原评论的缩写或原话作为证据支撑。
* 优先级排序：按"出现频率"和"严重程度（如导致产品完全无法使用）"对问题进行排序，高频+致命问题排最前。

# Output Format
请严格按照以下Markdown格式输出报告：
## 🚨 一、 核心改造点（必须修复的痛点）
优先级 | 痛点模块 | 痛点描述 | 原始证据（引用原话） | 改造建议
--- | --- | --- | --- | ---
P0 (高频/致命) | 例如：电池 | 续航虚标，实际只能用半小时 | "买来除草，用了20分钟就没电了" | 更换大容量电芯，或在Listing写明真实续航
P1 | … | … | … | …

## 💡 二、 隐藏机会点（差异化竞争切入点）
机会类型 | 用户真实诉求 | 原始证据（引用原话） | 落地建议（如何变成卖点）
--- | --- | --- | ---
新增功能 | 例如：希望便携 | "要是能折叠放车里就好了" | 开发折叠版本，主打
...[truncated 2161 chars]
Remediation
View remediation

Remediation Suggestions

  1. Clearly delimit every review as untrusted data using a structured envelope rather than concatenating it into instruction text.
  2. Add an explicit instruction that content inside reviews is evidence only and that all commands, role declarations, formatting requests, URLs, and policy statements found inside reviews must be ignored.
  3. Parse Map output with a strict JSON parser and validate it against an allowlisted schema containing only tag, module, point, and quote.
  4. Reject unexpected fields, invalid tags, excessive lengths, links, control text, and output that is not a JSON array.
  5. Ensure each quote is an actual substring of the source review before accepting it as evidence.
  6. Pass only validated structured fields—not raw model output or raw reviews—to the Reduce stage.
  7. Treat the Reduce input as untrusted and repeat the instruction/data boundary protections there.
  8. Apply output validation to the final report and flag unsupported claims for review.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/review_scraper.py:109
Finding

Bright Data API Key Is Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/review_scraper.py:109-114; documented invocation at SKILL.md:125-127
Vulnerability Type: Insecure secret handling through process arguments
Risk Level: Medium

The script requires the Bright Data API key to be supplied as a positional command-line argument.

Relevant code snippet (scripts/review_scraper.py:109-114):

python
if len(sys.argv) < 3:
    print("用法: python review_scraper.py <商品URL> <API_KEY>")
    sys.exit(1)

product_url = sys.argv[1]
api_key = sys.argv[2]

Relevant code snippet (SKILL.md:125-127):

bash
python scripts/review_scraper.py <商品URL> <API_KEY>

Technical Analysis

Process arguments are not an appropriate channel for secrets. Depending on the operating system and execution environment, command-line arguments may be visible through process inspection utilities, process metadata, job runners, shell debugging, monitoring agents, audit logs, or command telemetry. The documented invocation can also cause the literal key to be retained in shell history.

The script legitimately uses the key as a bearer credential for Bright Data and does not print it directly. The vulnerability concerns local credential exposure before or during execution, not unauthorized transmission to an unrelated endpoint.

Attack Path

  1. A user follows the documented command and places the Bright Data API key directly on the command line.
  2. The shell records the command in history, or the running process exposes its arguments through process inspection or execution logs.
  3. Another local user, administrator, monitoring service, CI-log reader, or other actor with access to that data obtains the key.
  4. The actor reuses the bearer credential against Bright Data.
  5. The actor consumes available quota or performs any API operations permitted by that credential.

Impact Assessment

Exploitation ...[truncated 399 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the API key positional argument.
  2. Prefer a secret manager or platform-provided credential injection mechanism.
  3. For local execution, read the key from a protected environment variable such as BRIGHTDATA_API_KEY.
  4. Alternatively, request it interactively with getpass.getpass() so it is not echoed or placed in shell history.
  5. Fail safely when the credential is absent and never include it in exceptions, debug logs, request dumps, or status output.
  6. Update SKILL.md so the documented invocation does not contain the secret.
  7. Scope the key to the minimum required Bright Data permissions and establish rotation and revocation procedures.
  8. Rotate any key that has already been used through the documented command if shell history, process telemetry, or CI logs may have captured it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior says the skill automatically triggers on Amazon URLs, performs Map-Reduce extraction, and generates an insights report, but the referenced implementation detail only mentions a local script taking command-line arguments and a third-party API dependency. This mismatch is dangerous because reviewers and users cannot reliably understand what actually runs, what external services receive data, or when automation occurs, increasing the chance of unsafe deployment and hidden data flows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes an external review-fetching tool and explicitly states it will save raw review data, but it does not declare any tool scope or permissions boundaries. This makes the network access and data persistence behavior under-specified, which can lead to overbroad execution, unexpected data handling, and weaker review-time enforcement of least privilege.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file consistently specifies the skill behavior and output format only in Chinese, which can effectively force a specific language/locale for use and responses. Under the policy, locale or language constraints should be optional, user-selectable, or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is designed to auto-fetch Amazon reviews as soon as a product URL is sent and to save the raw review data, yet the user-facing description does not warn that sending a link initiates network collection and storage. This undermines informed consent and can surprise users with external requests and retention of scraped content, especially in environments with privacy, compliance, or cost constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Natural-language strings and documentation throughout the script, including the module docstring and CLI usage text, are Chinese-only. This can violate a language/locale policy when a skill forces a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The script transmits a user-supplied Amazon product URL and an API bearer token to a third-party service (Bright Data). In the context of a skill that auto-triggers on user-provided links, this creates a real data-flow and trust-boundary issue: user inputs are sent externally without validation, explicit consent, domain restriction, or safeguards against misuse of the external scraping service.

Content

Scanner excerpt · scripts/review_scraper.py (reported line 29)May include surrounding context.

python
encoded_url = urllib.parse.quote(product_url, safe='')
    
    # 使用 Bright Data 的结构化数据 API 获取 Amazon 评论
    base_url = "https://api.brightdata.com/datasets/v3/amazon_product_reviews"
    
    headers = {
        "Authorization": f"Bearer {api_key}",

Static analysis

No suspicious patterns detected.