Facebook Marketplace Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 0.1.3

Overview

This skill is a disclosed local Marketplace search client with some dependency hygiene issues but no evidence of hidden, persistent, destructive, or exfiltrating behavior.

Install in a virtual environment, review or pin the dependencies before use, and only point MARKETPLACE_API_BASE_URL at a Marketplace service you control and trust. Be aware that the local service, not this wrapper, determines what Marketplace data is accessed and how it authenticates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Supply-chain exposure through unrestricted dependency versions and an unnecessary package
Risk Level: Medium

Vulnerable Code

text

Flask>=3.0.0
requests>=2.31.0

Technical Analysis

Both dependencies use open-ended minimum-version constraints. Consequently, future installations may resolve to package versions that were not available or reviewed when the skill was audited. This prevents reproducible dependency verification and exposes installations to future compromised, malicious, or incompatible releases and their transitive dependencies.

Flask is not imported or otherwise used by scripts/facebook_marketplace_search.py, which is the project's only executable script. Installing this unnecessary dependency expands the package's transitive dependency graph and supply-chain attack surface without supporting the declared client functionality.

No evidence indicates that the currently named packages are malicious. The risk arises from unrestricted future resolution and the unnecessary dependency, rather than from confirmed malicious behavior in a specific released package version.

Attack Path

1. A user follows the documented setup process and installs packages from requirements.txt.
2. The package manager resolves the latest versions satisfying the unrestricted >= constraints, including transitive dependencies.
3. If a future eligible release or one of its transitive dependencies is compromised, the affected package is downloaded without requiring a change to this repository.
4. Malicious installation hooks or subsequently imported runtime code execute with the privileges of the user performing the installation or running the skill.

This exploitation path is conditional on compromise of an eligible upstream package or package-distribution channel.

Impact Assessment

Successful exploitatio ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Flask because the executable script does not use it.
2. Pin requests and all required transitive dependencies to reviewed exact versions.
3. Generate a lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
4. Use an automated dependency scanner and update pinned versions through reviewed changes.
5. Install dependencies in an isolated virtual environment under a non-privileged account.
6. Periodically rebuild the lock file from trusted package indexes after reviewing security advisories and release provenance.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes capabilities that involve environment configuration, local file access for config/setup, and network access to a localhost HTTP service, but it does not declare any explicit tool scope or permissions. This creates a least-privilege gap: an agent or reviewer cannot easily constrain or audit what the skill is allowed to access, and the user-provided local service model increases risk because localhost services often expose sensitive data or privileged operations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specifier Flask>=3.0.0 is unpinned, so builds may resolve to different versions over time, reducing reproducibility and potentially pulling in a newly introduced vulnerable or incompatible release. In a security-sensitive service client, this weakens supply-chain control even though it is not an immediately exploitable code flaw by itself.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

Flask>=3.0.0
requests>=2.31.0

Unverifiable Dependency: Flask has 10 known advisory(ies) (CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Flask has known advisories, and because the manifest does not pin an exact version, it is impossible to verify from this file whether the installed package is patched or vulnerable. The danger is contextual rather than immediate: if deployment resolves to an affected version, the service could inherit known Flask vulnerabilities.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency specifier requests>=2.31.0 is unpinned, so installations may resolve to different versions depending on when and where the package is installed. This creates supply-chain uncertainty and may expose deployments to vulnerable or behavior-changing releases without code changes in the project.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

Flask>=3.0.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Requests has multiple known advisories, and the unpinned requirement prevents verification that the installed version includes the necessary fixes. Given this skill is a thin client for a local Marketplace service and likely performs outbound HTTP calls, an affected requests version could matter if malicious URLs, redirects, proxies, or credential-handling paths are involved.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest describes a Marketplace search client with search filters and normalized results, but does not mention reading process environment for configuration. Accessing environment variables is not necessary to perform a search itself and introduces an additional capability beyond the stated user-facing purpose.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:2