Security audit

ShopGeni

Security checks for vulnerabilities and agentic risk

Overview

This shopping skill has a coherent purpose, but it needs review because it can upload arbitrary local files to configurable network endpoints and creates an undisclosed persistent identifier.

Review before installing. Use it only if you are comfortable sending shopping queries and selected product images to the ShopGeni/BeyondStyle backend, avoid passing private files or sensitive photos as --image, and check that SHOPGENI_API_URL or --api-url has not been changed to an untrusted endpoint.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/shopgeni.py:134
Finding: Unrestricted Local File Upload Through the Image Parameter
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/shopgeni.py:24
Finding: Sensitive Requests Can Be Redirected to Arbitrary Network Destinations
Content: View full analysis
Remediation: View remediation

other

Note

Location: scripts/shopgeni.py:34
Finding: Persistent Installation Identifier Is Created and Transmitted Without Disclosure
Content: View full analysis
str: """Return a stable per-installation ID used for rate limiting (analogous to browser fingerprint).""" id_file = Path.home() / ".config" / "nestor" / "skill_id" id_file.parent.mkdir(parents=True, exist_ok=True) if id_file.exists(): return id_file.read_text().strip() client_id = str(uuid.uuid4()) id_file.write_text(client_id) return client_id ``` ```python headers = { "Content-Type": "application/json", "X-Nst-Uid": new_uid(), "X-Nst-Sig": get_client_id(), "X-Nst-Source": "skill", "Accept": "text/event-stream", } ``` ```python headers = { "Content-Type": f"multipart/form-data; boundary={boundary}", "Content-Length": str(len(body)), "X-Nst-Uid": new_uid(), "X-Nst-Sig": get_client_id(), "X-Nst-Source": "skill", "Accept": "text/event-stream", } ``` ### Technical Analysis The Skill creates a stable UUID in `~/.config/nestor/skill_id` and transmits it in the `X-Nst-Sig` header with every text and image request. This enables the backend to correlate requests across different invocations and conversation threads. The identifier is described in code as analogous to a browser fingerprint, but this persistent tracking behavior is not disclosed in `SKILL.md`. The file is also written without explicitly setting restrictive permissions, leaving its effective permissions dependent on the process umask and platform defaults. A rate-limiting mechanism may be legitimate, but a stable installation-wide identifier is not the least privacy-invasive option. ### Attack Path 1. The user invokes the Skill for the first time. 2. The script creates a UUID and stores it under the user’s home directory. 3. Each subsequent invocation reads the same UUID. 4. The U ...[truncated 741 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
--- ## Display Guidelines - **Item recommendations:** Show as a markdown table or bullet list with name, brand, price, and link - **Price comparison:** Show as a ranked table: `Rank | Store | Price | Link`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises executable behavior that likely needs network, filesystem, and environment access, but it declares no explicit tool scope or permissions. This weakens sandboxing and review because consumers cannot tell what capabilities are required, and a runtime may grant broader access than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill supports image-file and image-URL inputs and states that the backend uses images for visual similarity ranking, but it does not clearly warn users that these images or URLs may be transmitted to an external service. This creates a privacy and data-handling risk because users may submit personal photos or sensitive URLs without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill creates a stable per-installation identifier, stores it on disk, and transmits it as the X-Nst-Sig header on every request. This enables persistent cross-session tracking of the user or installation without any evident consent, notice, rotation, or documented necessity, creating a privacy and correlation risk if the remote service or logs are compromised or misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill sends user queries and, in image mode, local image contents to a remote third-party API, and it can also append an image URL into the transmitted query. In a shopping assistant this is functionally expected, but without an explicit user-facing warning or data-handling disclosure, sensitive text, embedded metadata, or private product images could be unintentionally exfiltrated off-device.
Content: No source excerpt is available for this finding.