ClawHub
Back to skill

Security audit

Ecommerce

Security checks for vulnerabilities and agentic risk

Overview

The e-commerce skill is mostly descriptive, but it tells users to install a broad unreviewed external multi-agent ecosystem that goes beyond the reviewed artifact.

Review the external `@andrew-myers/selling-skills` package separately before installing it. Prefer a pinned, reviewed version with documented permissions, provenance, and clear controls for store data, customer data, pricing changes, orchestration, and shared memory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:103
Finding

Unreviewed External Ecosystem Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:103
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Install the full ecosystem: `hermes skills install @andrew-myers/selling-skills`

Technical Analysis

The skill instructs users to install an external package that is not included in the audited project. The available project provides no immutable version pin, integrity hash, authoritative source reference, reviewed manifest, or permission declaration for this dependency. Consequently, the external package's code, transitive dependencies, and installation behavior cannot be verified from the audited artifact.

The requested dependency is described as a full multi-agent ecosystem involving orchestration and cross-agent memory, which is significantly broader than the stated e-commerce purpose of this skill. Installing a mutable and unreviewed ecosystem creates a supply-chain trust boundary: later changes to the externally resolved package could alter the effective payload without changes to this reviewed SKILL.md.

No malicious behavior in the external package is established by the available evidence. The confirmed issue is the unsafe recommendation to install an unreviewed, unpinned dependency.

Attack Path

  1. A user loads the e-commerce skill and follows its installation recommendation.
  2. The hermes package resolver obtains @andrew-myers/selling-skills from an external registry or source.
  3. Because no immutable version or integrity digest is specified, the resolved contents may differ from those originally intended or reviewed.
  4. The installer processes package-controlled code, manifests, or skill instructions with the privileges available to the invoking user or agent.
  5. If the package, publisher account, registry, or a transitive component is compromised, attacker-controlled behavior may execute or gain access to a ...[truncated 637 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the external installation instruction unless the full ecosystem is necessary for the skill's core functionality.
  2. Prefer installing only the minimum e-commerce component rather than a broad multi-agent ecosystem.
  3. Pin the dependency to an immutable, reviewed version or commit.
  4. Publish and verify a cryptographic integrity digest or signed provenance attestation before installation.
  5. Document the authoritative registry, source repository, publisher identity, requested permissions, installation hooks, and transitive dependencies.
  6. Vendor the required dependency into the audit scope or perform a separate security review of its complete contents.
  7. Execute installation in a sandbox with least privilege, restricted filesystem access, no unnecessary secrets, and limited network connectivity.
  8. Require explicit user confirmation before enabling orchestration, shared-memory, or other capabilities beyond the skill's stated e-commerce purpose.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep