Marketplace Local Search

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:41 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed local-service client for Marketplace search, with manageable cautions around configurable endpoints and unpinned dependencies.

Install this in a virtual environment, keep MARKETPLACE_API_BASE_URL pointed at your own local service or a trusted HTTPS endpoint, and remember that the configured service receives your query, location, and filters. Publishers should pin dependencies and remove Flask unless the package actually needs it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/facebook_marketplace_search.py:17

Finding

Unrestricted Service Endpoint Override Can Expose Search and Location Data

Content

View full analysis

Vulnerability Details

File Location: scripts/facebook_marketplace_search.py, lines 17, 31-32, and 73
Vulnerability Type: Unrestricted outbound endpoint configuration and plaintext transmission
Risk Level: Medium

Vulnerable Code

python

DEFAULT_BASE_URL = 'http://127.0.0.1:8787'

python

if os.getenv('MARKETPLACE_API_BASE_URL'):
    config['base_url'] = os.getenv('MARKETPLACE_API_BASE_URL')

python

r = requests.get(
    f"{cfg['base_url'].rstrip('/')}/search",
    params=params,
    timeout=cfg['timeout_seconds']
)

Technical Analysis

The skill is documented as a client for a local Marketplace service, but the MARKETPLACE_API_BASE_URL environment variable is accepted without validating its scheme, hostname, port, or locality. Consequently, the endpoint can be changed from the intended loopback service to an arbitrary remote server.

The request includes the user-supplied search query, location, radius, price range, and other filters as URL query parameters. If an HTTP endpoint outside the loopback interface is configured, this information is transmitted in plaintext and may also be recorded in intermediary or server access logs.

The issue does not provide arbitrary code execution by itself. Exploitation requires an attacker or compromised component to influence the process environment or configuration used to invoke the skill.

Attack Path

1. An attacker or compromised orchestration component sets MARKETPLACE_API_BASE_URL to an attacker-controlled URL, such as http://attacker.example.
2. A user or agent invokes the skill with a Marketplace query and location.
3. The script appends /search to the attacker-controlled base URL.
4. The request sends the query, location, and filtering preferences to the attacker-controlled server.
5. The attacker collects the disclosed information and can return fabricated Marketplace results that the script presents as ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured URL with urllib.parse.urlparse before issuing a request.
2. Permit only loopback destinations such as 127.0.0.1, localhost, and ::1 by default.
3. Reject unsupported schemes, embedded credentials, malformed ports, fragments, and unexpected URL paths.
4. Require HTTPS when remote service access is explicitly enabled.
5. Introduce a separate, clearly named opt-in setting for remote endpoints rather than allowing them implicitly.
6. Avoid sending sensitive parameters through plaintext HTTP or to untrusted services.
7. Document that the configured service receives the query and location data.
8. If remote redirects are unnecessary, disable them or validate every redirect target to prevent bypassing the hostname policy.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Mutable and Unnecessary Third-Party Dependencies Increase Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2
Vulnerability Type: Unpinned dependency versions and unnecessary dependency exposure
Risk Level: Low

Vulnerable Code

text

Flask>=3.0.0
requests>=2.31.0

The documented installation command in SKILL.md installs these mutable requirements:

bash

python3 -m pip install -r skills/facebook-marketplace-search/requirements.txt

Technical Analysis

Both dependencies use open-ended minimum-version constraints. Installation can therefore resolve to package versions that were not reviewed with the skill and may change over time. No hashes or lock file are supplied to verify artifact integrity or make installations reproducible.

Flask is not imported or used by the shipped client script. Installing it unnecessarily expands the dependency graph and exposes the environment to additional packages and future package vulnerabilities without supporting the implemented functionality.

This finding does not establish that the currently available packages are malicious. The risk arises from mutable future resolution, unnecessary dependency installation, and the absence of artifact integrity controls.

Attack Path

1. A user follows the documented setup command.
2. pip resolves the latest versions satisfying the open-ended constraints.
3. A future compromised, vulnerable, or incompatible release may be selected because no exact version or artifact hash is enforced.
4. Package installation or later import executes code from the newly resolved dependency in the user's Python environment.
5. The unnecessary Flask dependency and its transitive dependencies increase the number of packages through which this scenario could occur.

Impact Assessment

Dependency installation generally executes with the privileges of the user running pip. A malicious package release could therefore access that user's files, environme ...[truncated 306 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Flask unless the distributed skill actually implements and requires a Flask service.
2. Pin requests and all required transitive dependencies to reviewed versions.
3. Generate a lock file containing cryptographic hashes, for example with pip-compile --generate-hashes.
4. Install dependencies with hash enforcement, such as pip install --require-hashes.
5. Use an approved package index and prevent fallback to untrusted package sources.
6. Add automated dependency vulnerability and license scanning to the release process.
7. Periodically update pinned versions through a controlled review and testing workflow.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation describes network access to a local HTTP service, use of an environment variable override, and installation/runtime behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy gap: an agent or reviewer cannot easily determine that the skill may read environment configuration and make outbound requests, which increases the risk of unintended data exposure, misuse of local services, or over-broad execution in agent environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specifier uses a lower-bound only constraint, which makes builds non-reproducible and allows different environments to resolve different Flask versions over time. That increases supply-chain risk and makes it difficult to verify whether a deployed version includes known security fixes or is affected by a vulnerable release.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

Flask>=3.0.0
requests>=2.31.0

Unverifiable Dependency: Flask has 10 known advisory(ies) (CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The requests dependency is not pinned to a specific version, so installations may resolve to different releases depending on when and where the skill is deployed. This weakens reproducibility and can expose deployments to avoidable supply-chain or known-vulnerable-version risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

Flask>=3.0.0
requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest describes a thin client for a user-provided local Marketplace service, but the code also reads process environment variables to control the target base URL and timeout. Accessing environment state is not an obvious requirement for a simple Marketplace search wrapper and expands capability beyond the stated search behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.example.json:2