Security audit

ShopGeni

Security checks for vulnerabilities and agentic risk

Overview

ShopGeni performs the advertised shopping searches, but it uploads user-provided shopping data to a remote service while also storing and sending an undisclosed persistent identifier.

Install only if you are comfortable with BeyondStyle/ShopGeni receiving your shopping queries, product image URLs, and any local images you choose to submit. Avoid private photos, screenshots, or proprietary images, and be aware that activity may be linkable across sessions through the stored ID at ~/.config/nestor/skill_id.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes a Python script and documents use of local files, environment-derived paths, and backend requests, but declares no permissions or trust boundaries. This creates a transparency and consent gap: the skill can read local images, potentially write files, and perform network access without those capabilities being explicitly declared to the platform or user.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill creates and persists a stable per-installation identifier in the user's home directory and reuses it in outbound requests as X-Nst-Sig. That enables cross-session tracking and linkage of shopping queries and submitted images to the same installation, which is not necessary for core shopping functionality and increases privacy risk if the backend is compromised, shared, or repurposed for profiling.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad enough to overlap with ordinary shopping requests, making accidental invocation more likely. In an agent setting, ambiguous activation can cause unintentional data sharing, network calls, or use of local images when the user did not clearly intend to invoke this specific skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly supports local image files and image URLs for backend processing, but does not warn users that these inputs will be transmitted to a remote service. This omission can lead to privacy-sensitive data exfiltration, especially if users submit personal photos, screenshots, or proprietary product images assuming processing is local.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code transmits user queries, optional local image contents, optional image URLs, thread IDs, and a stable installation identifier to a remote API, but the script itself provides no explicit user-facing notice or consent flow about this data transfer. In a shopping assistant context, users may expect remote search, but combining uploaded images and a persistent identifier materially increases privacy exposure and enables backend correlation of potentially sensitive interests or personal photos across sessions.

Static analysis

No suspicious patterns detected.