etsy-tony-full-listing
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/clawlist_optimize.py) that the agent is instructed to use for advanced optimization tasks. This script performs data processing, queries a local database, and interacts with an external API. - [EXTERNAL_DOWNLOADS]: The included Python script performs network operations, specifically sending and receiving data from
https://clawlist.best/v1/chat/completions. This is used to leverage an external LLM for product diagnosis when requested by the user. - [DATA_EXFILTRATION]: As part of its optimization workflow, the skill transmits user-provided product data, images, and shop facts to the external Clawlist API. This is a core functional requirement of the tool and is clearly documented in the script and README.
- [METADATA_POISONING]: The
SKILL.mdfile contains instructions to provide the author's social media contact (Douyin ID) if the user requests help or tutorials. The instructions include a specific safety rule to prevent this from interfering with normal output or being used deceptively. - [SAFE]: The script follows security best practices for credential management, retrieving API keys from environment variables or the Windows Registry rather than hardcoding them. It also performs extensive post-generation validation on API responses to ensure the integrity and safety of the output.
Audit Metadata