store-order-query

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:06 AM UTC
• Version: 1.0.0

Overview

This skill matches its stated order-query purpose, but it handles database credentials and automatically stores raw order data locally, so users should review it carefully before installation.

Install only if you are comfortable giving the skill read access to your store database and storing a plaintext database config plus raw order exports on the local machine. Use a read-only database account limited to the needed tables, keep the skill data directory private and out of backups/repos if needed, delete exports when no longer needed, and verify the mysql2 version before deployment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill instructs the agent to read database credentials from a local config file and write queried order data to local storage, yet no permissions are declared. In a permissive runtime, this can lead to unauthorized access to sensitive business data or credential handling beyond what the user reasonably expects from the manifest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill instructs the agent to read database credentials from a local config file and write queried order data to local storage, yet no permissions are declared. In a permissive runtime, this can lead to unauthorized access to sensitive business data or credential handling beyond what the user reasonably expects from the manifest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill instructs the agent to read database credentials from a local config file and write queried order data to local storage, yet no permissions are declared. In a permissive runtime, this can lead to unauthorized access to sensitive business data or credential handling beyond what the user reasonably expects from the manifest.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill instructs the agent to read database credentials from a local config file and write queried order data to local storage, yet no permissions are declared. In a permissive runtime, this can lead to unauthorized access to sensitive business data or credential handling beyond what the user reasonably expects from the manifest.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly documents exporting raw order data to a local JSON file but does not warn that order records and line items may contain sensitive business data and potentially personal data depending on the deployment schema. In a real agent skill, this normalization of local raw-data export can lead to unnecessary data retention, wider filesystem exposure, and accidental disclosure through logs, backups, or repository commits.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes access to local configuration files and database credentials, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where a host system may allow broader filesystem or environment access than users expect, increasing the risk of unintended secret exposure or over-privileged execution.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger examples are broad enough to cause the skill to run for vague business-health questions, potentially initiating database access and local data export when the user did not explicitly request that level of action. In this context, the skill handles sensitive order and payment-related business data, so over-broad invocation increases the chance of unnecessary data retrieval and exposure.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill claims to query store order information, but it also persists a generated markdown report to disk. This expands behavior beyond the declared purpose and causes potentially sensitive business data derived from orders to be stored locally, increasing the risk of unintended disclosure, retention, or misuse on shared systems.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code creates directories and writes files under a persistent home-directory path even though the stated skill purpose is only to query order information. Unnecessary filesystem write access violates least privilege and can expose order-derived data to other local users, backups, logs, or later processes without the operator realizing the skill is leaving artifacts behind.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code creates a skill-specific directory under the user's home directory and establishes filesystem state beyond what is necessary for a simple read/query operation. In this skill's context, local storage capability is more dangerous because it enables silent retention of queried order data and configuration artifacts, broadening the attack surface and making data collection less transparent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as querying store order information, but it also persists the full queried order dataset, including order metadata and item details, to a local JSON file. This creates unnecessary at-rest retention of potentially sensitive business and customer-related data, increasing exposure if the host is multi-user, backed up externally, or later accessed by other processes.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill writes order records to a local JSON file without any user-facing warning or consent flow, so sensitive operational data may be retained unexpectedly. In a database-query skill, undisclosed persistence is especially risky because users reasonably expect retrieval, not covert local replication of order history.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: 文件中的用户说明、示例交互和操作步骤均以中文给出，没有提供语言/locale 选择，也未说明这是面向特定中文使用场景的受限技能。按规则，若技能强制特定语言而无用户 opt-in 或明确合理范围，属于自然语言策略问题。

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The skill instructions and user-facing behavior are entirely specified in Chinese, with no indication that the skill can adapt its output language based on user preference. This may violate a language/locale policy if the organization expects user opt-in or language choice rather than a fixed-language experience.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: L142 states that the generated report is saved in an "output" directory, while L070 says the report is written to `~/openclaw-skill-data/store-order-query/order_report.md`. This is an active contradiction in the skill documentation about where the report actually goes.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The code hard-codes `toLocaleString("zh-CN", { timeZone: "Asia/Shanghai" })`, which imposes a specific language/locale format on all generated reports. Under the policy, locale-specific behavior should be optional or clearly justified; this file provides neither a user opt-in nor an explanation that the skill is region-specific.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"analysis"
  ],
  "dependencies": {
    "mysql2": "^3.6.0"
  },
  "license": "MIT"
}

• Confidence: 92% confidence
• Finding: The dependency uses a caret range (^3.6.0), so installs may resolve to different mysql2 releases over time, reducing build reproducibility and making it harder to verify whether known security fixes are present. In a skill that directly connects to a MySQL database, dependency drift increases supply-chain and patch-management risk, though this manifest entry alone does not prove active compromise.

Unverifiable Dependency: mysql2 has 7 known advisory(ies) (GHSA-3f6p-5ww8-9rcr (MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credential); CVE-2024-21509 (mysql2 vulnerable to Prototype Poisoning); CVE-2024-21511 (MySQL2 for Node Arbitrary Code Injection) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The manifest declares mysql2 without an exact version, and the package has multiple known advisories, including issues such as prototype poisoning and arbitrary code injection in some releases. Because this skill's purpose is querying order data from a MySQL database, using an unverifiable and potentially vulnerable DB client increases the risk of credential exposure, unsafe query handling, or compromise of the runtime if an affected version is installed.

Static analysis

No suspicious patterns detected.