Ecommerce Bundle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

The skill’s e-commerce automation purpose is coherent, but its install path and business-impacting automations need careful review before use.

Review and pin the remote repository and all referenced skills before installing, inspect install.ps1 directly, and avoid running installation with elevated privileges. Configure only approved shops, platforms, and customer-message channels, and require human review before automated replies or review responses go live.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: README.md:7

Finding

Execution of Unpinned and Unreviewed External Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:66-80; README.md:7-9
Vulnerability Type: Supply-chain risk through mutable external dependencies and an unaudited remote installer
Risk Level: High

Vulnerable Code

SKILL.md:66-80:

powershell

# Competitor monitoring
py -m clawhub install spider
py -m clawhub install firecrawl-search
py -m clawhub install browser-automation

# Automatic replies
py -m clawhub install wechat-management
py -m clawhub install qqbot-cron

# Review management
py -m clawhub install agent-browser

# Product research
py -m clawhub install tavily-search
py -m clawhub install research

README.md:7-9:

powershell

git clone https://github.com/clawhub/ecommerce-bundle.git
cd ecommerce-bundle
./install.ps1

Technical Analysis

The installation instructions retrieve multiple third-party skills without pinning immutable versions, commit identifiers, cryptographic hashes, or verified publisher signatures. Consequently, the content installed by these commands can change after this artifact has been reviewed.

The README also directs users to clone a remote repository and execute install.ps1. That installer is not included in the submitted artifact, which contains only README.md and SKILL.md; therefore, its behavior could not be audited. Executing an unreviewed script obtained from a mutable remote branch creates a supply-chain execution boundary controlled by the upstream repository.

This does not prove that the referenced packages or repository are currently malicious. The vulnerability is that the documented installation process provides no mechanism to ensure users receive the same content that was reviewed.

Attack Path

1. An attacker compromises an upstream skill publisher account, package registry entry, repository, or maintainer credentials.
2. The attacker replaces a referenced package or the repository's install.ps1 with ...[truncated 1202 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every external skill to a specific immutable release version or commit hash.
2. Publish SHA-256 or stronger checksums for all downloaded artifacts and verify them before installation.
3. Require cryptographic signatures from documented, trusted publishers and fail closed if verification fails.
4. Reference the remote repository by an audited commit rather than a mutable default branch.
5. Include install.ps1 in the distributed project so its complete behavior can be reviewed with the rest of the artifact.
6. Configure the installer to avoid elevated privileges unless a specific operation requires them.
7. Maintain a dependency manifest or lockfile recording package names, versions, sources, hashes, and trusted publishers.
8. Review dependency updates before changing pinned versions and use automated supply-chain scanning where available.
9. Ensure the documented package inventory matches the files actually distributed in the artifact.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented trigger phrases are very broad, generic natural-language commands without clear scope limits, confirmation requirements, or negative examples. In an agent setting, this increases the chance of accidental invocation or misuse of actions related to competitor monitoring, automated customer replies, and analytics, especially because the skill handles business-impacting operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises external site monitoring and automated replies but does not clearly warn users about the operational, compliance, and safety implications of those features. This can lead users to enable scraping-like monitoring or automated customer communications without understanding platform restrictions, rate limits, reputational risks, or the need for human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes competitor monitoring, automated customer replies, and review handling across browser automation, messaging, and scraping-related components, but it provides no safeguards around consent, platform terms, account restrictions, privacy, or anti-abuse boundaries. In this context, the omission is dangerous because users may deploy automation against third-party platforms or customer data in ways that trigger account bans, privacy violations, or unauthorized monitoring at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

All user-facing instructions and command examples are written in Chinese, and the document does not indicate that the language is optional or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description and the rest of the file consistently prescribe Chinese-language prompts, responses, and trigger phrases, but do not state that the skill is region-specific or provide an opt-in language/locale choice. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.