T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Mutable Third-Party CLI Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
ordercli
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a disclosed food-order CLI wrapper, but it asks users to install an unpinned third-party executable that may handle passwords, browser cookies, and session tokens.
Review before installing. Use a pinned, trusted ordercli version if possible, avoid importing Chrome cookies or browser profiles unless you understand the session exposure, and do not provide Deliveroo tokens unless you specifically intend to test the unfinished Deliveroo flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 86% confidence
- Finding
The documented commands include importing Chrome cookies, reusing browser profiles, and creating sessions without a password, which are credential and session-token handling behaviors commonly associated with information-stealer tradecraft. In this agent-skill context, these features are especially risky because they enable account access by harvesting local browser state rather than using normal authentication flows, potentially exposing sensitive session material across services.
- Content
md ora reorder <orderCode>` - Confirm: `ordercli foodora reorder <orderCode> --confirm` - Address: `ordercli foodora reorder <orderCode> --confirm --address-id <id>` Cloudflare / bot protection - Browser login: `ordercli foodora login --email you@example.com --password-stdin --browser` - Reuse profile: `--browser-profile "$HOME/Library/Application Support/ordercli/browser-profile"` - Import Chrome cookies: `ordercli foodora cookies chrome --profile "Default"` Session import (no password) - `ordercli foodora session chrome --url https://www.foodora.at/ --profile "Default"` - `ordercli foodora session refresh --client-id android` Deliveroo (WIP, not working yet) - Requires `DELIVEROO_BEARER_TOKEN` (optional `DELIVEROO_COOKIE`). - `ordercli deliveroo config set --market uk` - `ordercli deliveroo history` Notes - Use `--config /tmp/ordercli.json` for testing. - Confirm before any reorder or cart-changing action.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is labeled as Foodora-only, but it documents Deliveroo commands and references Deliveroo bearer tokens and cookies. This scope mismatch can mislead users and automation about which services and credentials are involved, increasing the risk of accidental credential exposure or unintended cross-service use.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is labeled as Foodora-only, but it documents Deliveroo commands and references Deliveroo bearer tokens and cookies. This scope mismatch can mislead users and automation about which services and credentials are involved, increasing the risk of accidental credential exposure or unintended cross-service use.
- Content