Smart Shopper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:19 AM UTC
• Version: 1.1.0

Overview

This shopping skill is mostly understandable, but its billing script can charge by default and its product-comparison claims are stronger than what the code actually does.

Review before installing. Treat this as a search-link and local-list helper, not a reliable live price comparison engine. Do not pass SkillPay keys on the command line, and only run billing with explicit consent, a verified user ID, and the exact intended amount.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/billing.py:58

Finding

Billing API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/billing.py, lines 58-70
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code:

python

if __name__ == "__main__":
    p = argparse.ArgumentParser()
    p.add_argument("--user-id", required=True)
    p.add_argument("--amount", type=float, default=0.001)
    p.add_argument("--api-key", default=None)
    g = p.add_mutually_exclusive_group()
    g.add_argument("--charge", action="store_true", default=True)
    g.add_argument("--balance", action="store_true")
    g.add_argument("--payment-link", action="store_true")
    a = p.parse_args()
    if a.balance: r = balance(a.user_id, a.api_key)
    elif a.payment_link: r = payment_link(a.user_id, a.amount or 5.0, a.api_key)
    else: r = charge(a.user_id, a.amount, a.api_key)

Technical Analysis

The billing script permits the SkillPay API key to be supplied using the --api-key command-line option. Command-line arguments are not an appropriate secret-transport mechanism because they may be recorded in shell history, process-monitoring output, Agent execution traces, diagnostic telemetry, or orchestration logs.

The script already supports retrieving the key from the SKILLPAY_API_KEY environment variable, so exposing an additional command-line credential path is not necessary for the declared billing functionality. When supplied, the key is subsequently placed in the X-API-Key header for requests to SkillPay.

Attack Path

1. A user or Agent invokes billing.py with --api-key containing a valid SkillPay credential.
2. The operating system or execution environment exposes or records the complete process command line.
3. An attacker with access to process metadata, shell history, Agent logs, or execution telemetry extracts the credential.
4. The attacker submits requests to the documented SkillPay billing endpoints using the st ...[truncated 645 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the --api-key command-line option entirely.
• Retrieve the credential only from a protected environment variable or dedicated secret manager.
• If interactive credential entry is required, use a non-echoing input mechanism and do not retain the result in logs.
• Configure Agent and application logging to redact X-API-Key and other authentication values.
• Apply least-privilege authorization to the SkillPay key and restrict it to the required skill and billing operations.
• Rotate any key that has previously been passed through command-line arguments.
• Avoid including secrets in exception messages, debug output, process metadata, or telemetry.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/billing.py:34

Finding

Billing Script Performs a Charge by Default Without Explicit Action Selection

Content

View full analysis

Vulnerability Details

File Location: scripts/billing.py, lines 58-70
Vulnerability Type: Unsafe default financial operation and insufficient transaction validation
Risk Level: Medium

Vulnerable Code:

python

if __name__ == "__main__":
    p = argparse.ArgumentParser()
    p.add_argument("--user-id", required=True)
    p.add_argument("--amount", type=float, default=0.001)
    p.add_argument("--api-key", default=None)
    g = p.add_mutually_exclusive_group()
    g.add_argument("--charge", action="store_true", default=True)
    g.add_argument("--balance", action="store_true")
    g.add_argument("--payment-link", action="store_true")
    a = p.parse_args()
    if a.balance: r = balance(a.user_id, a.api_key)
    elif a.payment_link: r = payment_link(a.user_id, a.amount or 5.0, a.api_key)
    else: r = charge(a.user_id, a.amount, a.api_key)
    print(json.dumps(r, indent=2, ensure_ascii=False))
    sys.exit(0 if r.get("success") else 1)

The charge implementation forwards the caller-controlled amount directly:

python

def charge(uid, amount=0.001, key=None):
    k = _key(key)
    if not k: return {"success": False, "error": "SKILLPAY_API_KEY not set"}
    d = _post("/billing/charge", {"user_id": uid, "skill_id": SKILL_ID, "amount": amount,
        "currency": "USDT", "description": "Smart Shopper"}, k)

Technical Analysis

The --charge option is declared with default=True, and the final else branch also performs a charge whenever neither --balance nor --payment-link is selected. Therefore, running the script with only the required user ID and an available API key initiates a financial transaction.

Financial operations should require an explicit, affirmative action. The current behavior makes charging the unsafe default and provides no confirmation boundary before the request is sent. The script also does not locally enforce a positive amount, a maximum amo ...[truncated 1839 chars]

Remediation

View remediation

Remediation Suggestions

• Set --charge to default=False.
• Require exactly one explicit action by marking the mutually exclusive argument group as required.
• Reject execution when no billing action has been deliberately selected.
• Require explicit user confirmation immediately before every financial transaction; an Agent should not infer consent merely from loading or invoking the Skill.
• Validate that the amount is numeric, finite, positive, and no greater than a narrowly configured transaction limit.
• If the Skill always costs 0.001 USDT, remove arbitrary caller control over the amount or enforce that exact server-authorized price.
• Add a unique idempotency key to each intended transaction and safely reuse it during retries.
• Display the user ID, currency, and exact amount before confirmation without displaying credentials.
• Apply server-side authorization, transaction limits, duplicate detection, and rate limiting because client-side checks can be bypassed.
• Keep balance queries and payment-link generation separate from charging so read-only operations cannot accidentally trigger a transaction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The finding indicates the primary implemented behavior may be local list persistence rather than cross-platform shopping comparison. That discrepancy matters because hidden storage or alternate primary behavior can expose user data and undermine informed consent, even if the code is not overtly malicious.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The manifest declares no tool restrictions even though the skill appears to require environment access, file writes, and network access. In an agent ecosystem, missing scope declarations can lead to over-privileged execution, making it easier for the skill to access secrets, write persistent data, or reach external services without clear user or platform visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script can initiate a real billing charge or generate a payment link directly from command-line input without any confirmation prompt, consent check, or higher-level authorization guard. In a skill context where calls may be automated, this increases the risk of unintended or unauthorized charges if the script is invoked with a user ID programmatically or by mistake.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implementation does not match the advertised capability: it only builds search URLs and static platform trait summaries, while the skill metadata claims broader product comparison including local stores. This is dangerous because users may rely on the output as if it reflects actual shopping intelligence, leading to deceptive automation behavior and bad purchasing decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains hard-coded user-facing strings in Chinese for platform traits, output labels, and recommendation text. That creates a language/locale policy issue because the skill does not offer the user any way to choose another language or explicitly opt into Chinese output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code never fetches product listings, prices, or features; it only constructs platform search URLs and emits canned traits. In a shopping skill, this creates a misleading representation of comparison functionality, which can cause users or downstream agents to trust non-existent analysis and make poor or manipulated purchasing choices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code emits tips in Chinese only, and other user-facing strings in the file are also Chinese. That forces a specific language/locale on users without opt-in, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The formatted CLI output labels and headings are presented only in Chinese. Because the skill does not offer a language choice or explain a justified locale constraint, this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This file implements persistent price tracking, target-price storage, historical price updates, and alert state management. The manifest describes finding/comparing products, local/online shopping, and creating shopping lists, but does not mention ongoing price monitoring or alerts as part of the skill's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script’s user-facing strings in format_output are entirely in Chinese, which enforces a specific language for normal interaction. Under the policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata and module behavior overstate capabilities by implying product comparison and local-store search, while the code only builds marketplace search URLs for three online platforms. This can mislead users or downstream agents into trusting incomplete results, causing bad purchasing decisions and unsafe automation assumptions in a commerce context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing strings in the formatter are fixed in Chinese, which imposes a specific language on all users. The file does not provide any opt-in, configuration, or documentation indicating that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill emits user-facing natural-language strings such as headings, labels, and status text in Chinese throughout its export and display paths. Because the file does not offer any locale selection or document this as a justified region-specific constraint, it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The command set includes price tracking and alerts that are absent from the main manifest description. While not severe on its own, undocumented tracking behavior reduces transparency and may cause users to miss that the skill stores data or performs ongoing monitoring-like functions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The recommendation is hard-coded to prefer Temu when present and Amazon otherwise, without evaluating any product-specific data. This is risky because it presents an apparently reasoned recommendation that may bias users toward a merchant for arbitrary reasons, undermining trust and enabling deceptive steering.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring claims the script performs web scraping, but it never fetches or parses remote content. In a security-sensitive agent ecosystem, false claims about data acquisition can mislead reviewers, orchestrators, or users about provenance and freshness of results, reducing trust and enabling deceptive behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The function docstring says it generates search results for a platform, but it only creates a structured payload containing a search URL and filters. This semantic mismatch can cause downstream components to treat URL placeholders as validated product results, which is especially risky in shopping workflows where users may rely on ranking or comparison claims.

Content

No source excerpt is available for this finding.