Post-Purchase Upsell Flow

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:55 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent guide for adding post-purchase upsells, with a caution to verify the external Docker project before running it.

Before following the Docker instructions, review the repository, checkout a specific trusted release or commit, inspect docker-compose.yml for exposed ports, volumes, privileges, and secrets, and test payment flows with low-risk test credentials before connecting production accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:105

Finding

Unpinned Third-Party Repository and Container Execution

Content

View full analysis

(Apache-2.0), check out a release tag, and read its `docker-compose.yml` - it declares the images and ports that will run. From that checkout: ```bash docker compose up # open http://localhost:4321, complete /setup, then Settings → Payments ``` For production it deploys to Cloudflare Workers inside the free tier for typical funnel volumes, with the Postgres as the only real line item. ``` ### Technical Analysis The skill instructs users to clone an external repository, select an unspecified release tag, and execute the repository's Docker Compose configuration. It does not specify: - An immutable, reviewed Git commit hash - An exact release version - Cryptographic checksums or signed-release verification - Digest-pinned container images - A required security review of image sources, volume mounts, privileges, ports, and environment variables A release tag is not necessarily immutable. Repository maintainers or an attacker who compromises the upstream project may alter tags, Compose files, referenced images, or setup components after this skill has been audited. Container image tags can likewise be reassigned to different image contents. Executing `docker compose up` creates a code-execution path from third-party repository content to the user's host. The effective permissions depend on the generated Compose configuration and local Docker environment. Potentially dangerous configurations could include privileged containers, host filesystem mounts, Docker socket access, host networking, exposed services, or access to secrets supplied through environment variables. This is classified as **T08: Insecure Dependencies** because the skill introduces an unverified third-party repository and its c ...[truncated 1948 chars]

Remediation

View remediation

test "$(git rev-parse HEAD)" = "" ``` 3. Require signed release or commit verification and document the trusted signer identity and fingerprint. 4. Pin every container image in `docker-compose.yml` by immutable digest, for example: ```yaml image: example/application@sha256: ``` 5. Publish checksums or attestations for the reviewed Compose file and relevant configuration files. 6. Instruct users to inspect the Compose configuration before execution: ```bash docker compose config ``` 7. Require review for privileged mode, added Linux capabilities, host networking, writable host mounts, Docker socket mounts, exposed ports, device access, and secrets passed through environment variables. 8. Apply least privilege by using non-root containers, read-only filesystems, dropped capabilities, restricted networks, and narrowly scoped secrets. 9. Recommend testing in an isolated virtual machine or sandbox before production deployment. 10. Use automated dependency and image scanning, signed images, provenance attestations, and a documented update-review process. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file includes actionable commands to launch software locally and notes that ports will run, but it does not clearly warn the user that executing the command will start network-accessible services on their machine. Under the markdown-file warning criterion, operational steps that can affect system integrity should include a brief user-facing disclosure.

Content

No source excerpt is available for this finding.