Supermarket Deals (DE)

PassAudited by ClawScan on May 10, 2026.

Overview

The skill does what it advertises—searches Marktguru supermarket deals—but it sends your search terms and ZIP code to Marktguru and keeps small local config/cache files.

This appears safe for its stated purpose. Before installing, be comfortable with running a Node/npm build, sharing product searches and a ZIP code with Marktguru, and having defaults/cache stored under ~/.supermarket-deals.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may download/build npm development dependencies on the user's machine.

Why it was flagged

The skill requires a Node/npm setup step even though the registry install spec is empty. This is common for a CLI skill, and the lockfile/no install scripts reduce risk, but users should notice they are installing npm dependencies.

Skill content

cd path/to/supermarket-deals
npm install
npm run build

Recommendation

Install from a trusted source, review package.json/package-lock.json, prefer a locked install such as npm ci where practical, and avoid running setup as an administrator.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Marktguru can receive the products you search for and the postal code you use.

Why it was flagged

The code sends the user's product query and ZIP code to Marktguru's API, which is necessary for the advertised deal search but is still a third-party data flow.

Skill content

const SEARCH_ENDPOINT = "https://api.marktguru.de/api/v1/offers/search"; ... url.searchParams.set("q", query); url.searchParams.set("zipCode", zipCode);

Recommendation

Use this skill only if you are comfortable sharing search terms and ZIP codes with Marktguru; use a nearby ZIP if you want less precise location disclosure.

Note

ASI06: Memory and Context Poisoning

What this means

Someone with access to the local account could view the saved default ZIP/store preferences and cached Marktguru keys.

Why it was flagged

The skill persists local configuration and cached provider keys between runs. This is bounded and disclosed, but it means defaults such as a ZIP code remain on disk.

Skill content

Config is stored at `~/.supermarket-deals/config.json` ... API keys ... cached 6h in `~/.supermarket-deals/keys.json`

Recommendation

Review or delete ~/.supermarket-deals if you no longer use the skill or do not want local defaults retained.