ClawHub
Back to skill

Security audit

Kroger Grocery

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for Kroger grocery assistance, but it can modify a real shopping cart through an unpinned third-party CLI without consistently requiring explicit confirmation.

Review this before installing. Use a pinned or otherwise verified `kroget` release if possible, understand that Kroger credentials and OAuth tokens are stored under `~/.kroget/`, and require the agent to ask before any `--apply --yes` cart operation. The skill says it cannot check out or process payment, but it can still add items to your real cart.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/setup.md:4
Finding
Unpinned Installation of a Privileged Third-Party CLI Package## Vulnerability Details **File Location**: `references/setup.md:4-5` and `SKILL.md:19-24` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `references/setup.md:4-5`: ```bash pipx install kroget # or: pip install kroget ``` From `SKILL.md:19-24`: ```text Quick version: 1. `pipx install kroget` 2. Register app at developer.kroger.com → get client_id + client_secret 3. `kroget setup --client-id ... --client-secret ...` 4. `kroget auth login` → user authorizes in browser 5. Look up store: `kroget products search "test" --location-id <zip>` ``` ### Technical Analysis The setup instructions install `kroget` from a third-party package repository without pinning a reviewed version or verifying an artifact hash. Consequently, the code executed by these commands can change independently of the audited Skill. This dependency is subsequently entrusted with sensitive Kroger API client credentials and OAuth tokens stored under `~/.kroget/`. It is also authorized to search account-specific inventory and modify the user's grocery cart. If the upstream package, maintainer account, release pipeline, or package-distribution channel were compromised, a malicious release could execute during installation or command invocation with the user's local operating-system privileges. The audit found no evidence that the currently referenced project or package is malicious. The vulnerability is the absence of controls that bind installation to a specific reviewed artifact. ### Attack Path 1. An attacker compromises the upstream package publisher, release pipeline, or package repository and publishes a malicious `kroget` release. 2. A user follows the Skill instructions and runs `pipx install kroget` or `pip install kroget`. 3. Because no version or integrity hash is specified, the package manager retrieves the attacker-controlled release. 4. The maliciou ...[truncated 988 chars]
Remediation
## Remediation Suggestions 1. Pin `kroget` to an explicitly reviewed version rather than installing the latest release: ```bash pipx install "kroget==REVIEWED_VERSION" ``` 2. Publish the expected package version and cryptographic artifact hash in the setup documentation. 3. Use a hash-locked requirements file or equivalent reproducible installation mechanism for the package and its transitive dependencies. 4. Verify the package publisher, source repository, release signature, and build provenance before updating the pinned version. 5. Prefer `pipx` over a global `pip` installation to isolate the CLI in a dedicated environment. 6. Review each dependency update before changing the pin, and document the reviewed source revision corresponding to the release. 7. Grant only the minimum Kroger OAuth scopes required for product lookup and cart modification. 8. Revoke and rotate Kroger OAuth tokens and API credentials immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The manifest description contains very broad activation cues like 'order groceries,' 'build a grocery list,' and 'order the usual,' which can match common user requests and cause the skill to trigger in many ordinary shopping contexts. Because this skill can perform state-changing actions such as adding items to a real Kroger cart, over-broad routing increases the risk of unintended invocation and unauthorized or surprising cart modifications.

Session Persistence

Medium
Category
Rogue Agent
Content
## 2. Register a Kroger Developer App

1. Go to [developer.kroger.com](https://developer.kroger.com)
2. Create an account
3. Create a new app:
   - Name: anything (e.g., "My Grocery Assistant")
   - Redirect URI: `http://localhost:8400/callback`
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
This writes `~/.kroget/config.json`. Secure it:
```bash
chmod 600 ~/.kroget/config.json
```

## 4. Find Your Store's Location ID
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
This writes `~/.kroget/config.json`. Secure it:
```bash
chmod 600 ~/.kroget/config.json
```

## 4. Find Your Store's Location ID
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
Or use the Kroger Locations API directly:
```bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Or use the Kroger Locations API directly:
```bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Or use the Kroger Locations API directly:
```bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low
Confidence
94% confidence
Finding
The setup guide includes a live `kroget cart add --apply --yes` command that will modify the user's real Kroger cart, but it does not give a clear warning immediately adjacent to the command that this changes account state. In a setup/testing context, users may copy-paste commands blindly, causing unintended cart modifications and confusion, especially because this skill is specifically designed to act on a real grocery account.