Security audit

Retail Agent Setup

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed retail-agent onboarding workflow with sensitive setup steps, but the access and persistence are coherent with its purpose and include user confirmation points.

Before installing, treat this as a business-system onboarding tool: use test or least-privilege API credentials, avoid uploading raw customer PII, store secrets only as environment or secret-manager references, review what is saved in agent memory, and confirm channel activation and cron jobs before going live.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises extensive file parsing, state persistence, and channel/API integration, but it does not declare permissions even though its documented behavior implies file read, file write, and network access. This is dangerous because users and the platform cannot accurately scope or gate the skill's capabilities, increasing the risk of overbroad access to sensitive business data and external systems.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill is described as an interactive onboarding wizard, but the referenced behavior includes standalone parsing, scoring, and test-generation scripts that can process files and emit artifacts outside the expected conversational flow. This mismatch is risky because it can cause users to authorize or supply sensitive retail data under a narrower trust assumption than the skill's actual operational footprint.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger phrases are broad enough to overlap with ordinary requests about store setup or retail AI, which can cause the skill to activate when the user did not intend to enter a stateful onboarding workflow. In this skill, accidental activation is more dangerous because it initiates data collection, persistence, and potentially external integrations across multiple steps.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This section invites uploads and structuring of product, policy, staff, customer, and other business data, but it provides no clear privacy notice, retention disclosure, or guidance to avoid regulated/sensitive personal data. That creates a meaningful risk of ingesting confidential company records or customer information without informed consent, appropriate minimization, or handling constraints.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states that each step's output is written to agent memory and that the workflow is resumable, but it does not warn users that onboarding artifacts will be persistently retained. In a retail setup context, those artifacts may include system inventories, escalation contacts, channel configuration details, and other sensitive operational metadata that users may not expect to be stored long term.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The documentation hard-codes China-specific defaults (WeCom for staff, WeChat Official Account for customers) based on the stated primary market, but does not clearly require user confirmation of region or provide explicit regional scoping before applying those defaults. In an onboarding skill, this can misconfigure communications, create privacy/compliance mismatches, and steer non-China retailers into unsuitable platforms without informed consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs saving a detailed system inventory to agent memory, which may retain sensitive business infrastructure information such as vendors, integration capabilities, and operational tooling. In an onboarding context this data collection is expected, but persisting it without minimization, retention limits, or consent guidance creates unnecessary exposure if memory is later accessed by other skills, users, or logs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs operators to provide API keys/secrets or OAuth credentials and perform live test fetches, but gives no guidance on secure secret handling, storage, masking, least-privilege scopes, or safe transmission. In an onboarding workflow for retail systems, this can lead to accidental exposure of production credentials or unnecessary access to sensitive business/customer data during setup.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill explicitly instructs the flow to collect sensitive values such as API keys and manager contacts, but it does not define any safeguards like masking, secure secret storage, least-privilege handling, redaction from logs, or a user-facing notice. In an onboarding wizard that persists configuration to agent memory, this increases the risk that secrets or personal contact data are mishandled, exposed in transcripts, or stored in insecure locations.

Static analysis

No suspicious patterns detected.