Cross Listing AI

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:05 PM UTC
• Version: 0.1.0

Overview

This is a coherent seller-listing guidance skill, with the main caution being optional maintainer publishing scripts that run external tooling if someone executes them.

Installers can treat this as a normal listing-helper skill, but should expect it to process seller photos and item details for pricing research. Do not run the publish scripts unless you are maintaining the package; if you do, run them in a clean isolated environment and pin or lock the skills CLI dependency first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/publish-skills.sh:18

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: scripts/publish-skills.sh:18-22
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

require_command "npx"

(
  cd "$repo_root"
  npx skills check
)

Technical Analysis

The publishing validation workflow executes npx skills check without pinning the skills package to an audited version or integrity-protected dependency. The project has no corresponding dependency declaration or lockfile.

When the package is not already installed locally, npx may retrieve and execute the package currently associated with the skills name in the configured registry. The code executed by this command can therefore change independently of the reviewed repository. A compromised package release, registry account, or package-resolution source could introduce arbitrary code into the publishing workflow.

Attack Path

1. An attacker compromises the package, its maintainer account, or a registry source used to resolve skills.
2. The attacker publishes a malicious version under the package name resolved by npx.
3. A repository maintainer runs npm run publish:skills or npm run publish:all.
4. The npm script invokes scripts/publish-skills.sh.
5. npx skills check downloads or resolves the mutable package version and executes its lifecycle or command code.
6. The malicious code runs under the maintainer's account in the project directory.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user running the publishing command. The malicious package could read or modify repository files, access environment variables and user-readable credentials, alter release artifacts, or misuse publishing credentials available to that process.

The impact is limited by the invoking user's operating-system permissions and any sandboxing or credential isolation applied to the ...[truncated 91 chars]

Remediation

View remediation

Remediation Suggestions

1. Add the audited skills package at an exact version to devDependencies.
2. Commit the generated package lockfile so dependency versions and integrity hashes are reproducible.
3. Replace the command with npx --no-install skills check so the publishing workflow cannot download an undeclared package.
4. Install dependencies in CI with a lockfile-enforcing command such as npm ci.
5. Review package provenance and integrity before version updates, and use automated dependency scanning.
6. Run publishing in an isolated environment with minimal credentials and filesystem permissions.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md

- [`references/extraction.md`](./references/extraction.md): image extraction and clarification guidance
- [`references/pricing.md`](./references/pricing.md): live comp and pricing guidance
- [`references/final-output.md`](./references/final-output.md): seller-facing response shape
- marketplace-specific output rules under `references/marketplaces/`
- [`references/examples.md`](./references/examples.md): compact sequencing examples

## How To Use The Skill

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes an AI-assisted seller listing workflow focused on image analysis, pricing, and marketplace listing generation. The supplied code does none of that. Instead, it is a simple shell script that orchestrates publishing by invoking two other scripts. This is a materially different primary purpose and an undeclared capability related to deployment/publishing automation, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an end-user listing assistant for analyzing item photos and generating marketplace listings. The supplied code does not implement any listing, image analysis, pricing, or seller workflow behavior. Instead, it is a release/publishing utility for packaging and publishing the repository to ClawHub. This is a materially different primary purpose and includes undeclared operational capabilities related to deployment/release management.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill provides AI-assisted seller listing workflows from item photos, including analysis, clarification, pricing, and listing generation. The actual code does none of that. Instead, it is operational tooling for publishing a skill repository: validating repository files, checking git cleanliness and branch synchronization, invoking npx skills check, and emitting install instructions. This is a materially different primary purpose and includes undeclared capabilities related to repository management and publication infrastructure. Therefore, the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an end-user AI skill that helps sellers create cross-listed marketplace listings from photos. The supplied code does not implement that workflow. Instead, it is a developer-oriented shell test harness for release/publish scripts. Its primary actions are creating temporary repos, copying scripts, making git commits, configuring remotes, faking clawhub and npx, and asserting expected output/exit behavior of publishing scripts. While marketplace filenames appear in test fixtures, they are only validated as required repository contents, not used for listing generation. This is a material purpose and capability mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/publish-scripts.test.sh (reported line 183)May include surrounding context.

sh

local repo_dir="$TEST_TMP_ROOT/clawhub-files"
  create_fixture_repo "$repo_dir"
  copy_script "$repo_dir" "publish-clawhub.sh"
  rm "$repo_dir/agents/openai.yaml"

  (
    cd "$repo_dir"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/publish-scripts.test.sh (reported line 206)May include surrounding context.

sh

local repo_dir="$TEST_TMP_ROOT/clawhub-marketplace"
  create_fixture_repo "$repo_dir"
  copy_script "$repo_dir" "publish-clawhub.sh"
  rm "$repo_dir/references/marketplaces/ebay.md"

  (
    cd "$repo_dir"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enables implicit invocation but provides no activation constraints, examples, or guardrails limiting when the agent should auto-select it. In a seller workflow, this can cause the agent to invoke the skill from loosely related photo, pricing, or marketplace requests, creating unintended data flow to the skill and increasing the chance of inappropriate autonomous actions or user confusion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script executes npx skills check without pinning an exact package version, so it may fetch and run whatever version of the skills package is currently resolved by npm at execution time. In a publish workflow, this creates a supply-chain risk: a compromised upstream package, typosquat, or unexpected breaking change could execute arbitrary code on the maintainer's machine or CI environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.