ClawHub
Back to skill

Security audit

Kroger Grocery

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for Kroger grocery assistance, but it can modify a real shopping cart through an unpinned third-party CLI without consistently requiring explicit confirmation.

Review this before installing. Use a pinned or otherwise verified `kroget` release if possible, understand that Kroger credentials and OAuth tokens are stored under `~/.kroget/`, and require the agent to ask before any `--apply --yes` cart operation. The skill says it cannot check out or process payment, but it can still add items to your real cart.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/setup.md:4
Finding

Unpinned Installation of a Privileged Third-Party CLI Package

Content
View full analysis

Vulnerability Details

File Location: references/setup.md:4-5 and SKILL.md:19-24
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

From references/setup.md:4-5:

bash
pipx install kroget
# or: pip install kroget

From SKILL.md:19-24:

text
Quick version:
1. `pipx install kroget`
2. Register app at developer.kroger.com → get client_id + client_secret
3. `kroget setup --client-id ... --client-secret ...`
4. `kroget auth login` → user authorizes in browser
5. Look up store: `kroget products search "test" --location-id <zip>`

Technical Analysis

The setup instructions install kroget from a third-party package repository without pinning a reviewed version or verifying an artifact hash. Consequently, the code executed by these commands can change independently of the audited Skill.

This dependency is subsequently entrusted with sensitive Kroger API client credentials and OAuth tokens stored under ~/.kroget/. It is also authorized to search account-specific inventory and modify the user's grocery cart. If the upstream package, maintainer account, release pipeline, or package-distribution channel were compromised, a malicious release could execute during installation or command invocation with the user's local operating-system privileges.

The audit found no evidence that the currently referenced project or package is malicious. The vulnerability is the absence of controls that bind installation to a specific reviewed artifact.

Attack Path

  1. An attacker compromises the upstream package publisher, release pipeline, or package repository and publishes a malicious kroget release.
  2. A user follows the Skill instructions and runs pipx install kroget or pip install kroget.
  3. Because no version or integrity hash is specified, the package manager retrieves the attacker-controlled release.
  4. The maliciou ...[truncated 988 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin kroget to an explicitly reviewed version rather than installing the latest release:
    bash
    pipx install "kroget==REVIEWED_VERSION"
  2. Publish the expected package version and cryptographic artifact hash in the setup documentation.
  3. Use a hash-locked requirements file or equivalent reproducible installation mechanism for the package and its transitive dependencies.
  4. Verify the package publisher, source repository, release signature, and build provenance before updating the pinned version.
  5. Prefer pipx over a global pip installation to isolate the CLI in a dedicated environment.
  6. Review each dependency update before changing the pin, and document the reviewed source revision corresponding to the release.
  7. Grant only the minimum Kroger OAuth scopes required for product lookup and cart modification.
  8. Revoke and rotate Kroger OAuth tokens and API credentials immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description contains very broad activation cues like 'order groceries,' 'build a grocery list,' and 'order the usual,' which can match common user requests and cause the skill to trigger in many ordinary shopping contexts. Because this skill can perform state-changing actions such as adding items to a real Kroger cart, over-broad routing increases the risk of unintended invocation and unauthorized or surprising cart modifications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 15)May include surrounding context.

md
## 2. Register a Kroger Developer App

1. Go to [developer.kroger.com](https://developer.kroger.com)
2. Create an account
3. Create a new app:
   - Name: anything (e.g., "My Grocery Assistant")
   - Redirect URI: `http://localhost:8400/callback`

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 30)May include surrounding context.

This writes ~/.kroget/config.json. Secure it:

bash
chmod 600 ~/.kroget/config.json

4. Find Your Store's Location ID

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 65)May include surrounding context.

This writes ~/.kroget/config.json. Secure it:

bash
chmod 600 ~/.kroget/config.json

4. Find Your Store's Location ID

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 42)May include surrounding context.

Or use the Kroger Locations API directly:

bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 42)May include surrounding context.

Or use the Kroger Locations API directly:

bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 59)May include surrounding context.

Or use the Kroger Locations API directly:

bash
curl -s "https://api.kroger.com/v1/locations?filter.zipCode.near=YOUR_ZIP&filter.limit=5" \
  -H "Authorization: Bearer ACCESS_TOKEN"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup guide includes a live kroget cart add --apply --yes command that will modify the user's real Kroger cart, but it does not give a clear warning immediately adjacent to the command that this changes account state. In a setup/testing context, users may copy-paste commands blindly, causing unintended cart modifications and confusion, especially because this skill is specifically designed to act on a real grocery account.

Content

No source excerpt is available for this finding.