Security audit

Etsy Seller Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill is a non-executable Etsy coaching guide, but it gives under-scoped advice about using buyer emails and customer lists that could mishandle customer personal data.

Review this skill before installing if you plan to use it for scaling or selling an Etsy business. Its business advice may be useful, but customer emails and customer lists should only be used or transferred after confirming buyer consent, Etsy rules, applicable privacy law, and appropriate retention, deletion, unsubscribe, and secure-transfer controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:204
Finding: Unconsented Export of Buyer Email Addresses to Third-Party Marketing Platforms
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:216
Finding: Unsafe Treatment of Customer Lists as Transferable Business Assets
Content: View full analysis
$1K/mo profit), private brokers. - Buyer due-diligence focuses on: traffic-source mix, review-decline risk, product-defendability, supplier-redundancy, IP issues. - **Critical:** Etsy's ToS technically forbid shop transfers. Most exits are **assignment-of-assets** (designs, supplier list, customer list, brand IP, social handles) not the literal Etsy account. Price and contract accordingly. ``` ### Technical Analysis The Skill identifies a customer list as an asset that may be assigned to a purchaser when an Etsy business is sold. Customer lists can contain names, email addresses, delivery details, purchase histories, and other personal or commercially sensitive information. The guidance warns about Etsy account-transfer restrictions but does not provide equivalent safeguards for personal-data transfer. It does not require verification of a lawful transfer basis, customer notice or consent where applicable, data minimization, secure transfer, contractual processing restrictions, or deletion of data that is unnecessary for the transaction. An assignment-of-assets structure does not by itself make the transfer of personal information authorized. Treating customer PII like designs or brand intellectual property could cause disclosure to a buyer outside the purpose for which Etsy customers originally supplied the information. ### Attack Path 1. A seller asks the Agent how to exit or sell an Etsy business. 2. The Agent recommends an assignment-of-assets transaction that includes the customer list. 3. The seller exports customer records or provides database, spreadsheet, or account-derived data to a prospective purchaser. 4. The records are disclosed during due diligence or after closing without adequate minimization, cons ...[truncated 968 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly advises sellers to capture post-purchase buyer emails from Etsy into external marketing tools without any warning about consent, privacy law obligations, or Etsy platform-policy limits. This can lead users to misuse customer data for off-platform marketing in ways that violate privacy regulations or marketplace rules, exposing them to account enforcement, complaints, or legal risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.