Security audit

Walmart Product Detail

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a coherent Walmart product-page extractor, but it includes explicit rate-limit evasion guidance using multiple stealth browser sessions.

Install only if you are comfortable with a Walmart scraping workflow. Use conservative, user-directed collection, respect Walmart's terms and rate limits, and avoid the stealth multi-session throughput guidance. Check the disclosed memory file path if you do not want troubleshooting notes to persist between runs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill explicitly advises increasing throughput by opening multiple stealth browser sessions and distributing work so rate limits apply per session. That goes beyond normal page extraction and provides operational guidance for anti-scraping evasion, which can facilitate abuse of a target site's defenses and terms-based restrictions.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The skill instructs the agent to read and append to a local memory file without clear user notice or consent, creating side effects outside the immediate extraction task. Even though the content is framed as operational notes, silent filesystem writes can leak task context across runs, surprise users, and violate least-privilege expectations for a scraping skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.