ClawAudit verdict

ecwid

ecwid-ecommerce

88
🟢 Trusted
Low risk — reviewed by ClawAudit, behavior matches stated purpose

The skill appears to be a legitimate integration with the Ecwid e-commerce platform and does not exhibit any malicious behavior.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

100
security
80
transparency
90
maintenance

Findings (1)

Coarse signal — prose, single-step high

Instruction-prose smuggling shape detected: collects a sensitive target ("Bearer token") and emits it outward ("POST"). Phrased as prose with no trigger tokens — a semantic prompt-injection / data-exfil pattern the syntactic scanners can't see. Final tier capped at Caution; review the instructions before installing.

SKILL.md · | Setting | Value | |---|---| | **Service name** | Ecwid | | **Base URL** | `https://app.ecwid.com/api/v3/{storeId}` (replace `{storeId}` with your actual store

Permissions & capabilities

Requires 2 environment variables. (1 sensitive: ECWID_SECRET_TOKEN).

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API