Security audit

E-commerce Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ecommerce research helper, but its published install guidance uses an unpinned placeholder npx installer that could fetch unreviewed code.

Review the installer source before running it, replace the placeholder owner with a verified publisher, and prefer a pinned version or commit. Do not run the npx install command with elevated privileges, and only provide Taobao API credentials you are comfortable using for ecommerce research workflows.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:64
Finding: Unpinned External Installer Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation
add /ecommerce-openclaw-skills ``` 2. Replace `your-username` with the canonical publisher or repository identity before release. 3. Publish cryptographic checksums or signed release artifacts and document how users can verify them. 4. Include the actual package manifest and lockfile so dependency versions and integrity metadata can be reviewed. 5. Prefer a workflow that downloads the package without executing it, permits inspection, verifies its integrity, and only then performs installation. 6. Configure trusted registries explicitly and use package provenance or signature verification where supported. 7. Avoid running installation commands with administrative or root privileges. 8. Ensure the published artifact contains the implementation described by its documentation so that all installed executable content can be audited. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The 'Use when' description is broad enough to match many generic ecommerce-assistance requests, which can cause the skill to activate in situations beyond its intended scope. Over-broad activation increases the chance that a tool with external API access is invoked unnecessarily, potentially exposing data or causing unintended actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description strongly emphasizes Chinese-language content and China-platform workflows without indicating that language or locale should be chosen based on user preference. This can override user expectations, cause misleading outputs, or route assistance into a region/language-specific mode the user did not request.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The install command uses npx skills add your-username/ecommerce-openclaw-skills without pinning a specific version or immutable reference. This can cause consumers to fetch whatever package version is current at install time, increasing supply-chain risk if a future release is compromised or unexpectedly changed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The changelog headings and feature descriptions are written entirely in Chinese, which constitutes a language-specific presentation with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, language constraints should either be optional or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This plain-text project file presents nearly all descriptive content in Chinese, including operational details and contact information, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking audience. Under the policy rule for language or locale constraints, this can be a natural-language policy issue because it effectively forces a language without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.