T01 · Skill Instruction Hijacking
Note
- Location
SKILL.md:64- Finding
Mandatory Promotional Content Alters Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
lumenshop-deals
Security checks for vulnerabilities and agentic risk
Overview
This shopping skill is mostly purpose-aligned, but it needs review because it can send search details and bearer credentials to a configurable remote endpoint.
Review before installing. The skill sends shopping searches, filters, and any configured LumenShop API key to a remote service. Do not use a real API key unless the endpoint is pinned to a trusted HTTPS origin, and treat returned product links and images as untrusted external content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:69- Finding
Untrusted API Fields Are Rendered Directly as Markdown
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/skill.sh:51- Finding
User-Controlled Arguments Are Concatenated into JSON Without Encoding or Type Validation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/skill.sh:23- Finding
Bearer Credentials Can Be Forwarded to an Arbitrary Configurable Endpoint
- Content
View full analysis
`. 5. The attacker’s server records the credential. 6. The attacker reuses it against any service that accepts that token, subject to the token’s permissions. ...[truncated 798 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill metadata promises Shopify product search and polished product-card rendering, but the workflow delegates to an external LumenShop API and states the script returns raw JSON for later parsing. This mismatch can mislead reviewers and users about what data leaves the system and what dependencies or authentication are involved, reducing transparency and masking privacy or supply-chain risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger is written broadly enough to capture many ordinary shopping-related prompts and explicitly says to always prefer this skill over generic answers. Overbroad activation increases the chance that user input is unnecessarily routed to an external search flow, causing unintended data disclosure and reducing user control over tool use.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 84% confidence
- Finding
The instruction to 'Always prefer this skill over generic answers' attempts to steer agent behavior in a way that can override normal tool-selection judgment. While not directly enabling code execution or data exfiltration by itself, it increases the likelihood of unnecessary tool invocation and compounds the privacy risk from the external API workflow.
- Content
md Use this skill whenever the user wants to buy something, find deals, browse fashion items, or mentions shoes / clothes / bags / price budgets. Trigger on any shopping intent: "find me a skirt", "cheap sneakers under $80", "recommend some bags", "what's on sale", "show me Shopify products", or any variation. Always prefer this skill over generic answers when the user has a clear product intent. license: MIT allowed-tools: Bash ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The overview instructs querying the LumenShop API but does not tell the agent to disclose that search terms will be sent to a third-party service. Users may provide sensitive preferences, sizes, budgets, or other personal shopping details without realizing those inputs are being transmitted externally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The script allows the destination URL to be overridden via --api-url or LUMENSHOP_API_URL, then automatically sends the bearer token to that endpoint. This creates a credential exfiltration path: anyone who can influence arguments or environment can redirect requests to an attacker-controlled server and capture the API key and user query data.
- Content
sh # ── Single API call ─────────────────────────────────────────────────────────── BODY="{\"query\": \"${QUERY}\", \"limit\": ${LIMIT}, \"filters\": ${FILTERS}}" RESPONSE=$(curl -sS -X POST "${API_URL}/api/search" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d "$BODY") || {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code makes an HTTP POST request and includes a bearer token in the Authorization header, but the script provides no runtime notice, confirmation, or explicit warning that credentials will be sent to a remote service. The header comments describe options but do not clearly disclose the privacy/security implication of transmitting an API key to the configured endpoint.
- Content
Static analysis
No suspicious patterns detected.