Security audit
Security checks for vulnerabilities and agentic risk
This skill can automate Whole Foods ordering, including optional auto-buy and calendar entries, but those behaviors are disclosed, configurable, and bounded by user policy.
Before installing, decide whether you want true auto-buy or cart-only review. Use add_to_cart_only or confirm_before_buy:true if you want final approval before any charge, set max_auto_spend conservatively, and disable calendar_blocking_enabled if you do not want delivery details written to your calendar.
The top-level description says the skill orders groceries using browser automation, but it does not prominently warn that it may place purchases automatically and may also create calendar events based on saved policy. This weakens informed consent because users may enable or invoke the skill without realizing it can trigger financial transactions and write data to external services.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Use the browser tool to drive the Whole Foods website. Prefer the default OpenClaw browser profile unless the user explicitly asks for a different one. The expected app default is the `user` browser profile.
Do not ask the user for Whole Foods or Amazon credentials. If login is required, ask the user to log in manually in the OpenClaw browser and continue after the session is ready.
If the browser tool is available, do not claim that some separate Tongue routing step or hidden Whole Foods action is required before you can browse, build the cart, or place the order. Use the browser tool you have. If something is blocked, explain the concrete blocker and the next recovery step.
This language establishes a policy for spending 'without asking again,' enabling the agent to make purchase decisions later under saved thresholds. In a commerce skill, delegated purchasing is inherently sensitive because mistakes, stale preferences, or prompt ambiguity can convert directly into unauthorized or surprising charges.
- `calendar_blocking_enabled`: boolean
If one or more required config values are missing, pause the ordering flow and ask the user these setup questions clearly:
1. What is the maximum total you want me to spend without asking again?
2. Should I place the order automatically when policy allows, or only build the cart?
3. Do you want me to always ask before buying, even if the total is under your threshold?
4. What delivery window of the day should I prefer when I pick a slot, for example `10:00-22:00`?
Allowing checkout without confirmation when several conditions are met is a real autonomous-action risk because the agent can complete a financial transaction on the user's account. The surrounding safeguards reduce risk, but they do not eliminate harms from incorrect item matching, account-context mistakes, price drift, or misunderstood user intent.
- Treat the user's saved config as policy, not as a suggestion.
- `confirm_before_buy: true` always requires confirmation before checkout.
- `purchase_mode: add_to_cart_only` never places an order.
- `purchase_mode: auto_buy` may place the order without confirmation only when:
- `confirm_before_buy` is `false`
- the estimated total is known
- the estimated total is less than or equal to `max_auto_spend`
The skill expands beyond grocery ordering into calendar-event creation, which is a separate side-effecting capability not clearly scoped by the manifest description. Even though it is framed as a convenience feature and gated by configuration, it can disclose order timing/details into another system and perform actions the user may not expect from an ordering skill.
The instruction to create calendar events 'without asking again each time' authorizes recurring autonomous writes to another user data system. While lower impact than automatic purchases, it can still expose schedule, shopping, and location context and may create unwanted or privacy-sensitive records.
Calendar follow-up:
- If the host environment also provides a calendar skill or helper, and `calendar_blocking_enabled` is true, create a calendar event that blocks the confirmed delivery window without asking again each time.
- If `calendar_blocking_enabled` is false, do not offer or create a calendar event unless the user explicitly changes that preference.
- Use a sensible title such as `Whole Foods delivery` or `Whole Foods pickup`.
- Include a short description listing the store or fulfillment context when visible, the main items or order summary when helpful, and any delivery notes or confirmation details you observed.
No suspicious patterns detected.