Walter Competitor

亚马逊竞品流量攻防智能分析。自动发现竞品、分析流量结构、识别弱点、生成攻击矩阵。无需手动提供ASIN，全自动竞品情报获取。

This skill bundles working code that expects you to install and configure a third‑party CLI (mcporter) with a SellerSprite secret, but the package metadata doesn't declare those requirements — that's a red flag. The code runs mcporter via subprocess.run(..., shell=True) and builds shell commands from input values without robust escaping: untrusted or specially crafted keywords could lead to command injection. Before installing or running it: - Confirm you trust the skill author and SellerSprite service. The owner is unknown and there is no homepage. - Do not supply production credentials or secrets until you understand where they'll be stored. The skill expects a secret-key in mcporter config (or URL) but does not declare an environment variable or secure storage mechanism. - Consider running the code in an isolated environment (VM/container) and review/modify the sellersprite_mcp.run_mcporter call to avoid shell=True or to properly escape/encode arguments. - Ask the author to: (1) declare required binaries and credentials in metadata, (2) remove shell usage or add safe escaping, and (3) document what data is sent to external endpoints and retention policies. Given these mismatches and the subprocess usage, treat this skill as suspicious until the above issues are resolved or you can audit and sandbox its execution.

Type: OpenClaw Skill Name: walter-competitor Version: 1.0.0 The skill bundle contains a critical shell injection vulnerability in `scripts/sellersprite_mcp.py`. The `run_mcporter` function executes system commands via `subprocess.run(shell=True)` using unsanitized string concatenation of arguments in the `_call` method, which allows for potential remote code execution (RCE) if the agent processes malicious user input. While the core logic in `scripts/traffic_analysis_v2.py` and `scripts/unified_data_layer_v2.py` appears legitimately designed for Amazon competitor analysis, the insecure implementation of the MCP bridge poses a significant security risk.