T06 · System Persistence
Error
- Location
references/step-12-iterate.md:30- Finding
Persistent Cross-Session Agent Execution Through Scheduled System Events
- Content
View full analysis
- Remediation
View remediation
Security audit
Retail Agent Setup
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate retail-agent onboarding workflow, but it sets up persistent memory, live integrations, recurring jobs, and knowledge-base edits without enough guardrails for credentials, privacy, and authorization.
Review this skill carefully before installing in a live retail environment. Use sandbox or read-only API credentials, do not paste raw secrets into chat, avoid importing customer PII, require authenticated staff-only channels for knowledge edits, and create recurring jobs only with clear recipients, expiry, audit, and deletion controls.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
references/step-12-iterate.md:131- Finding
Persistent Knowledge-Base Poisoning Through Unauthenticated Conversational Corrections
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/step-03-data-import.md:23- Finding
API Secrets May Be Collected Through Chat and Persisted in Agent State
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/parse_policy.py:58- Finding
Unbounded Parsing of Untrusted Documents Enables Resource Exhaustion
- Content
View full analysis
list[dict]: if not HAS_PANDAS: raise ImportError("pandas is required: pip install pandas openpyxl") df = pd.read_csv(filepath, dtype=str) return _parse_dataframe(df, vertical) def parse_excel(filepath: str, vertical: str) -> list[dict]: if not HAS_PANDAS: raise ImportError("pandas is required: pip install pandas openpyxl") df = pd.read_excel(filepath, dtype=str) return _parse_dataframe(df, vertical) ``` ```python def extract_text_from_pdf(filepath: str) -> str: if not HAS_PDF: raise ImportError("pdfplumber is required: pip install pdfplumber") with pdfplumber.open(filepath) as pdf: pages = [page.extract_text() or "" for page in pdf.pages] return "\n\n".join(pages) def extract_text_from_docx(filepath: str) -> str: if not HAS_DOCX: raise ImportError("python-docx is required: pip install python-docx") doc = DocxDocument(filepath) return "\n".join(para.para for para in doc.paragraphs if para.text.strip()) ``` ```python kb_path = Path(args.kb) if not kb_path.exists(): print(f"Error: File not found: {kb_path}", file=sys.stderr) sys.exit(1) kb = json.loads(kb_path.read_text(encoding="utf-8")) ``` ### Technical Analysis The parsers load complete CSV, Excel, PDF, DOCX, text, and JSON inputs into memory. No limits are enforced for: - Uploaded file size. - Decompressed archive size. - Spreadsheet row, column, or worksheet count. - PDF page count. - Extracted text length. - JSON nesting, entry count, or total size. - CPU time or parsing duration. - Per-process memory consumption. PDF, Excel, and DOCX formats may contain compressed or structurally ...[truncated 1446 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
scripts/requirements.txt:1- Finding
Open-Ended Dependency Versions Make Installations Non-Reproducible
- Content
View full analysis
=2.0.0 openpyxl>=3.1.0 # For PDF parsing (Step 03) pdfplumber>=0.10.0 # For DOCX parsing (Step 03) python-docx>=1.1.0 ``` ### Technical Analysis Every third-party dependency uses an open-ended minimum version. As a result, two installations performed at different times can resolve to different package versions and transitive dependency graphs. The repository provides no lock file, integrity hashes, or upper compatibility bounds. A future release selected by the package resolver may not have been reviewed with this Skill and could introduce vulnerabilities, incompatible behavior, or compromised supply-chain code. The package names themselves are consistent with the stated functionality, and no typosquatted or known malicious dependency was identified from the reviewed files. The confirmed weakness is non-reproducible and insufficiently integrity-controlled dependency resolution. ### Attack Path 1. An operator installs dependencies from `requirements.txt`. 2. The package resolver selects the newest releases satisfying the lower bounds. 3. A selected direct or transitive release differs from the versions used during the Skill audit. 4. Installation executes package build or installation behavior, and later parsing imports the newly resolved code. 5. Any vulnerability or compromise in that unreviewed dependency becomes reachable through document parsing. ### Impact Assessment The resulting privilege level is that of the environment installing or running the Python dependencies. Depending on deployment practices, an affected dependency could access: - Files readable by the parser process. - Uploaded retail documents. - Process environment variables. - Output locations writable by the parser. - Network resources available to the runtime. No actual ...[truncated 101 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says this skill is an onboarding wizard used to set up and configure a retail AI employee. The supplied code does not implement onboarding, setup steps, configuration collection, or customization logic. Instead, it builds and outputs test cases for validating an already configured retail agent before launch, with scoring guidance and pass thresholds. That is a materially different primary purpose, so this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill is an onboarding/setup wizard for a retail AI employee agent, specifically a 12-step configuration flow for businesses. The supplied code does not implement onboarding, configuration, conversational setup, retail agent customization, or any wizard behavior. Instead, it is a standalone document parsing script for policy documents. It accesses input files, extracts text, identifies policy categories, parses sections/conditions/process steps or Q&A pairs, and emits structured JSON. This is a materially different primary purpose and includes undeclared document-processing capabilities unrelated to the declared retail onboarding use case.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill is an onboarding wizard for configuring a retail digital employee agent through a 12-step setup flow. However, the supplied code contains no onboarding flow, no agent configuration logic, no wizard behavior, no triggers related to setup, and no customization of an AI assistant. Instead, it is a standalone product-catalog ingestion tool that reads CSV/XLS/XLSX files, normalizes columns, infers categories, parses product attributes, and outputs JSON plus quality scores. This is a materially different primary purpose, so the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code does not perform a multi-step onboarding flow, agent setup, or configuration/customization of a retail AI employee. Instead, it is a standalone Python CLI utility that loads a JSON knowledge base, computes section scores, identifies gaps, and emits a report/recommendation. While this could support an onboarding pipeline, its actual primary purpose is auditing/scoring knowledge base completeness, which is materially different from the declared description.
- Content
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md Setup steps: 1. Log into mp.weixin.qq.com → Basic Configuration 2. Enable Developer Mode 3. Note: `AppID`, `AppSecret` 4. Set server URL to OpenClaw gateway endpoint 5. Set Token (any string, must match OpenClaw config)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill references scripts, file ingestion, memory writes, and channel/API setup, which implies file read/write and possible network-capable behavior without any declared tool scope or permissions boundary. That creates an authorization gap: users and the platform cannot tell what capabilities are intended, and a downstream runtime may grant broader access than necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad enough to activate on ordinary 'setup' requests, which can cause unintended invocation of a high-impact workflow that collects business data, writes persistent state, and may later activate channels. In skill-routing systems, overbroad triggers increase the chance of surprise execution and accidental data disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that each step persists artifacts in agent memory and that the setup is resumable, but it does not clearly warn users that business configuration details and imported knowledge will be stored across sessions. Hidden persistence increases the risk of accidental retention of sensitive operational data and later reuse in unrelated contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Step 03 explicitly asks users to send uploaded business data, potentially including customer, staff, inventory, and policy documents, but provides no privacy, minimization, or retention warning. In the retail context this can expose sensitive commercial information and personal data, especially when files are auto-parsed and transformed into persistent knowledge base artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Channel integration and launch steps include activation on external messaging platforms, sending welcome messages, and scheduling reminders, yet there is no prominent warning or hard confirmation gate before these externally visible actions occur. That can lead to unintended outbound communication, unauthorized account linkage, and automated follow-up actions with real business consequences.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The decision hard-codes China-specific communication channels and market assumptions as the primary default without any explicit user opt-in or locale detection. In an onboarding skill, opinionated defaults can silently steer deployments toward region-specific platforms that may be inappropriate for the business, creating compliance, privacy, operational, and accessibility risks for non-China retailers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly directs the agent to save a detailed system inventory in agent memory, which can reveal a store's internal technology stack, integration posture, and weaker/manual processes. Even if it does not collect credentials, this operational metadata is sensitive and could enable targeted attacks or unwanted retention if stored without clear notice, consent, retention limits, or access controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs operators to collect API credentials and perform a live test fetch, but it does not include safeguards around secure secret handling, least-privilege scopes, masking, storage, consent, or the risk of pulling real production data. In a retail onboarding context, this can expose customer, inventory, pricing, or operational data and may trigger unintended actions or load against live systems during setup.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains natural-language guidance that fixes the agent's tone and forms of address to Chinese (e.g. using "您" or "亲") and all sample interactions are in Chinese. Under the policy, forcing a specific language or locale without user opt-in is a violation unless a justified region-specific constraint is documented, which is not stated here.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
{ "sentiment_analysis": true, "auto_escalate_keywords": ["投诉", "曝光", "律师", "消协", "骗子"], "refund_auto_approve_limit": 0, "response_style": "empathetic" }
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The report-generator configuration sends sales and returns data to an external channel (
wecom) and recipient identifiers without warning about data sharing scope, recipient validation, or least-privilege distribution. That can lead to operational or commercially sensitive data being sent to the wrong users or channels, especially in an automated reporting workflow.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The setup flow explicitly asks for sensitive values such as API keys and manager contact details but provides no guidance on secure collection, storage, masking, access control, or retention. In an onboarding skill that saves configuration into agent memory, this omission creates a realistic risk of credential exposure or unnecessary collection of personal data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The fallback response is hardcoded in Chinese without any documented locale selection or user preference handling. This can mislead or exclude non-Chinese-speaking users during failure cases, increasing the chance of misunderstandings around support escalation, returns, or safety-relevant product questions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The configuration explicitly enables logging of unknown user queries and repeated-query alerting, but the step provides no user-facing notice, retention limits, or guidance on handling potentially sensitive customer inputs. In a retail assistant context, users may submit personal data, purchase issues, allergy information, or other sensitive free-text content, so silent retention creates a privacy and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The persona guidance is framed around Chinese names, 2–3 character naming rules, and later Mandarin-specific tone settings, which effectively constrains the skill to a specific language/locale. Because the document does not state that language should be selected based on user preference or regional context, it risks violating language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The sample kiosk configuration hard-codes Chinese-language welcome text, which can impose a specific language on end users. The document does not state that this step is only for Chinese-speaking deployments or provide an opt-in or alternative locale guidance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The escalation template explicitly includes a customer issue summary and a conversation link, but the document provides no minimization, access-control, or redaction guidance for sensitive data. In a retail support context, escalation messages can easily contain personal data, order details, contact information, or complaint history, so sending full context to WeCom/SMS recipients without privacy constraints can cause unauthorized disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The escalation template and auto-escalation keywords are written in Chinese and appear to define the required operating language for important workflow behavior. There is no indication that language is configurable or limited to a justified region-specific deployment, so this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation section provides only Chinese welcome messages for staff and customer-facing channels, with no indication that language should match user preference or locale choice. This creates a natural-language policy concern because the skill appears to mandate a specific language by default rather than offering an opt-in or configurable locale.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The real-time alert template explicitly forwards raw customer question text to a manager via WeCom, which can expose personal, sensitive, or regulated information if customers include it in their queries. In this retail onboarding context, the feature is designed for operational feedback, but the lack of minimization, redaction, consent, or privacy guidance makes unintended data disclosure to internal recipients a realistic risk.
- Content