Swiggy_T1

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:53 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for Swiggy ordering, but it handles real-world purchases while shipping a missing safety-enforcing CLI and persisting sensitive order details without clear controls.

Install only if you are comfortable giving the agent Swiggy account access and manually confirming every order or booking. Treat the current package as requiring review before use because its documented CLI is missing and its order log may retain addresses, purchases, totals, and order IDs in local memory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:186

Finding

Order Records Persist Sensitive Location and Purchase Data Without Defined Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:186-196
Vulnerability Type: Plaintext persistence of sensitive personal and transactional data
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Order Logging

After successful order, append to `memory/swiggy-orders.json`:
```json
{
  "timestamp": "2026-01-28T21:16:00+05:30",
  "type": "food",
  "items": [...],
  "total": "₹560",
  "address": "HSR Layout",
  "orderId": "..."
}

text

The skill additionally directs the agent to map location aliases to addresses stored in `USER.md` at `SKILL.md:107-109`:

```markdown
### Address Handling
- User may say "home", "office", etc. - map to actual addresses from USER.md or ask
- Always confirm delivery location in preview

Technical Analysis

The mandatory logging workflow stores order contents, monetary totals, delivery locations, timestamps, and order identifiers in a persistent JSON file. The skill does not specify:

• User consent for persistent logging
• Data minimization or address redaction
• Restrictive filesystem permissions
• Encryption at rest
• Retention or automatic deletion policies
• Protection against access by unrelated agents, tools, or local users

Purchase history combined with timestamps and delivery locations is sensitive personal data. It may reveal dietary preferences, habitual locations, occupancy patterns, and financial activity. Although this is not agent-memory poisoning because the records are operational data rather than attacker-controlled future instructions, it is an insecure data-handling practice.

Attack Path

1. A user completes a food or grocery order.
2. Following the skill instructions, the agent appends the order details to memory/swiggy-orders.json.
3. The record includes item details, total cost, delivery location, timestamp, and order identifier.
4. Another local process, user, plugin, or agent session with acc ...[truncated 618 chars]

Remediation

View remediation

Remediation Suggestions

• Make persistent order logging explicitly opt-in rather than mandatory.
• Store only the minimum information required for the stated use case.
• Exclude full addresses, detailed item lists, and order identifiers unless specifically required.
• Replace exact addresses with user-controlled labels where possible.
• Create the file with owner-only permissions, such as mode 0600.
• Define a short retention period and provide a command to inspect and delete stored records.
• Encrypt records at rest when sensitive details must be retained.
• Avoid reading addresses from shared profile files unless the user has approved that data source for the current transaction.
• Document which components and agent sessions can access the stored records.

T08 · Insecure Dependencies

Note

• Location: package.json:21

Finding

Wildcard Peer Dependency Prevents Reproducible Supply-Chain Review

Content

View full analysis

Vulnerability Details

File Location: package.json:21-23
Vulnerability Type: Unbounded third-party dependency version
Risk Level: Low

Vulnerable Code Snippet:

json

"peerDependencies": {
  "clawdbot": "*"
},

Technical Analysis

The wildcard constraint declares every version of clawdbot compatible with this package. Consequently, installation and runtime behavior can vary according to whichever version is already present or selected by the package manager. The complete audited project structure also contains no lockfile or other integrity metadata that would identify a reviewed dependency version.

Modern npm versions may install peer dependencies automatically when they are not otherwise present. Where the host supplies the peer dependency, the wildcard accepts that host version without establishing a reviewed compatibility or security boundary.

This finding does not prove that the named dependency is malicious. The risk is that future, compromised, or incompatible releases can satisfy the manifest without any change to the audited package.

Attack Path

1. A user installs the skill in an environment without a fixed, independently managed clawdbot version.
2. The package manager or host resolves a later version because the wildcard accepts every version.
3. That release contains a vulnerability, compromised code, or behavior not reviewed with this skill.
4. The dependency executes with the permissions available to the host application or installing user.
5. The affected dependency can compromise data or operations available within those existing privileges.

Exploitation depends on a vulnerable or compromised upstream release, registry compromise, or an unsafe host-provided version; the wildcard alone does not create direct code execution.

Impact Assessment

Potential impact is bounded by the privileges and data available to the resolved clawdbot package. Depending on th ...[truncated 254 chars]

Remediation

View remediation

Remediation Suggestions

• Replace * with a reviewed, narrow semantic-version range.
• Prefer an exact version when reproducibility is more important than automatic updates.
• Test and document every supported major version.
• Add an integrity-bearing lockfile where dependency installation is performed by this package.
• Use automated dependency review and vulnerability scanning before accepting upgrades.
• Configure update tooling to submit version changes for review rather than silently accepting all future releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: package.json:5

Finding

Security-Enforcing CLI Is Declared but Missing From the Package

Content

View full analysis

Vulnerability Details

File Location: package.json:5-8 and README.md:85-99
Vulnerability Type: Missing implementation of a documented transaction safety control
Risk Level: Medium

Vulnerable Code Snippet:

package.json:5-8 declares an executable that is absent from the complete project:

json

"main": "bin/swiggy",
"bin": {
  "swiggy": "./bin/swiggy"
},

README.md:85-99 claims that this executable enforces confirmation:

markdown

### Confirmation Required

The `--confirm` flag is **mandatory** for all orders and bookings. This prevents accidental purchases.

Without `--confirm`:
```bash
swiggy food order --address "home"
# ❌ Error: --confirm flag required

With --confirm:

bash

swiggy food order --address "home" --confirm
# ✅ Order placed

text

### Technical Analysis

The provided complete directory structure contains only `README.md`, `SKILL.md`, and `package.json`; there is no `bin/swiggy` implementation. Therefore:

- `npm link` cannot expose the documented functional CLI.
- The claimed fail-closed enforcement of `--confirm` cannot be inspected or tested.
- No implementation demonstrates validation of confirmation state before an MCP order or booking call.
- The documentation presents an enforcement guarantee that the distributed artifact does not supply.

`SKILL.md` contains behavioral instructions requiring user confirmation, which is a useful procedural safeguard. However, procedural instructions are not equivalent to a locally enforced transaction boundary. Because the missing CLI means the documented operation may simply fail, this issue is primarily an absent and unverifiable safety control rather than a demonstrated direct bypass.

### Attack Path

1. A user installs the package and runs `npm link` as documented.
2. The package points the `swiggy` command to the nonexistent `bin/swiggy` path.
3. The documented wrapper and its claimed
...[truncated 1222 chars]

Remediation

View remediation

Remediation Suggestions

• Include the referenced bin/swiggy executable in the distributed package.
• Implement confirmation validation in a single fail-closed transaction function used by every order and booking path.
• Reject missing, malformed, stale, or transaction-mismatched confirmations.
• Bind confirmation to the exact cart, total, address, booking time, guest count, and authenticated account.
• Require renewed confirmation whenever any transaction detail changes.
• Add automated tests proving that order and booking requests cannot reach MCP endpoints without valid confirmation.
• Verify package contents in CI, for example by inspecting the output of npm pack --dry-run.
• Remove the CLI declaration and enforcement claims if no CLI is intended to be shipped.
• Document whether the remote MCP services independently enforce confirmation rather than relying solely on agent instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest advertises food ordering, grocery purchases, and restaurant booking, all of which can trigger real-world external actions and potentially affect a user's account, money, or reservations. There is no warning in the manifest about network access, third-party service interaction, or the need for explicit confirmation before placing orders, which increases the risk of users invoking consequential actions without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The description explicitly says the skill is for ordering food, groceries, and booking restaurants "in India." For this rule set, locale-specific constraints should either offer user choice or be clearly documented as a justified regional limitation; this file provides no such explanation beyond the phrase itself.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using a wildcard peer dependency for clawdbot allows installation with any version, including insecure or incompatible releases. In a security-sensitive skill that can place orders through remote MCP servers, this increases supply-chain and runtime risk because the actual host behavior and protections may vary unpredictably.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"license": "MIT",
  "dependencies": {},
  "peerDependencies": {
    "clawdbot": "*"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: clawdbot has 11 known advisory(ies) (CVE-2026-26317 (OpenClaw affected by cross-site request forgery (CSRF) through loopback browser ); GHSA-chm2-m3w2-wcxm (OpenClaw Google Chat spoofing access with allowlist authorized mutable email pri); CVE-2026-26328 (OpenClaw iMessage group allowlist authorization inherited DM pairing-store ident) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The manifest relies on clawdbot without pinning its version, while advisories are known to exist for that package. Because this skill can drive account-linked ordering flows over external MCP endpoints, an affected host version could expose spoofing, authorization, or request-forgery weaknesses that materially increase user risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.