ecommerce-category-collector 安全扫描报告 — 可疑 | ClawSafe

45 /100

ecommerce-category-collector

电商分类采集技能 - Automated e-commerce category collection tool for Audtools platform

Skill exposes hardcoded credentials in documentation, contains unused dangerous imports, and performs web scraping with unclear data handling practices.

技能名称ecommerce-category-collector

分析耗时41.3s

引擎pi

⚠

谨慎使用

Remove hardcoded credentials from documentation, eliminate unused child_process imports, and clarify data handling policies for collected e-commerce data.

安全发现 4 项

严重性	安全发现	位置
高危	Hardcoded credentials in documentation 凭证窃取 Real Audtools account credentials (username: 15715090600, password: zzw12345) are exposed in plain text in SKILL.md precondition section `1. Audtools账号（手机号：15715090600，密码：zzw12345）` → Remove credentials from documentation and use environment variables or config files instead	`SKILL.md:11`
中危	Unexplained child_process import 敏感访问 scripts/collector.js imports execSync from child_process module but never uses it - suspicious dormant code `const { execSync } = require('child_process');` → Remove unused imports or document the legitimate use case	`scripts/collector.js:13`
中危	Undeclared browser automation capability 文档欺骗 SKILL.md does not declare the skill uses browser automation tools (browser:WRITE) - only mentions 'browser tool' in description `自动从Audtools电商采集工具批量提交分类链接采集任务` → Explicitly declare browser automation permissions in capability section	`SKILL.md:1`
低危	External third-party data collection 文档欺骗 Skill automates scraping of third-party e-commerce sites (zaraoutlet.top) without declaring data collection scope or handling policy `const CONFIG = { baseUrl: 'https://www.audtools.com', ... };` → Document what data is collected, how it's processed, and where it's stored	`scripts/collector.js:37`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`READ`	✓ 一致	scripts/collector.js:14 - fs.readFileSync
浏览器	`NONE`	`WRITE`	✓ 一致	scripts/collector.js:45-280 - browser.open/act/evaluate
命令执行	`NONE`	`READ`	✓ 一致	scripts/collector.js:13 - execSync imported but unused

15 项发现

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/version-1.0.0-blue

README.md:3

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/OpenClaw-Skill-green

README.md:4

🔗

中危外部 URL 外部 URL

https://img.shields.io/badge/license-MIT-orange

README.md:5

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-blazers

SKILL.md:47

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-bodies

SKILL.md:48

🔗

中危外部 URL 外部 URL

https://www.audtools.com/users/shopns#/users/shopns/collecs?spm=m-1-2-3

SKILL.md:79

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-cardigans-jumpers

references/csv-format.md:45

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-co-ord-sets

references/csv-format.md:46

🔗

中危外部 URL 外部 URL

http://shop.example.com/collections/all

references/csv-format.md:60

🔗

中危外部 URL 外部 URL

https://www.example.com/collections/summer-dresses

references/csv-format.md:61

🔗

中危外部 URL 外部 URL

https://www.audtools.com

scripts/collector.js:15

🔗

中危外部 URL 外部 URL

https://www.audtools.com/login

scripts/collector.js:16

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-dresses

test/sample.csv:6

🔗

中危外部 URL 外部 URL

https://zaraoutlet.top/collections/woman-collection-jackets

test/sample.csv:7

🔗

中危外部 URL 外部 URL

https://shop.example.com/collections/all

test/sample.csv:10

目录结构

6 文件 · 29.7 KB · 1013 行

JavaScript 1f · 573L Markdown 3f · 406L JSON 1f · 25L CSV 1f · 9L

├─ ▾ 📁 references

│ └─ 📝 csv-format.md Markdown 156L · 4.4 KB

├─ ▾ 📁 scripts

│ └─ 📜 collector.js JavaScript 573L · 16.3 KB

├─ ▾ 📁 test

│ └─ 📄 sample.csv CSV 9L · 1015 B

├─ 📋 package.json JSON 25L · 682 B

├─ 📝 README.md Markdown 150L · 3.8 KB

└─ 📝 SKILL.md Markdown 100L · 3.5 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`csv-parse`	`^5.5.0`	npm	否	Version properly pinned

安全亮点

✓ No reverse shell or C2 infrastructure detected

✓ No base64-encoded or obfuscated code

✓ No unauthorized access to system paths like ~/.ssh or ~/.aws

✓ No cron/persistence mechanisms

✓ No data exfiltration to unknown external IPs

✓ Dependency csv-parse has pinned version (^5.5.0)

✓ No typosquatting or supply chain risks detected