PPSPY: Shopify spy for dropshipping & shopify sales tracker tool

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:56 AM UTC
• Version: 1.0.3

Overview

This PPSPY skill is a coherent e-commerce intelligence connector, with expected but important risks around paid API credits, remote account changes, and a globally installed npm MCP server.

Install only if you trust PPSPY and the ppspy-mcp-server npm package. Use a revocable PPSPY API key with spending or quota limits, avoid running the install as an administrator, and approve any create, edit, delete, stop, or cancel monitoring action because those can change your PPSPY account and consume credits or quota.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Globally Installed Third-Party npm Package Executes with Access to an API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–24
Vulnerability Type: Supply-chain exposure through global installation and execution of an unaudited third-party dependency
Risk Level: Medium

yaml

requires:
  env:
    - PPSPY_API_KEY
  bins:
    - npm
install:
  command: npm
  args:
    - install
    - -g
    - "ppspy-mcp-server@1.0.1"
primaryEnv: PPSPY_API_KEY
emoji: "🔍"
homepage: https://www.ppspy.com
mcpServers:
  ppspy:
    command: ppspy-mcp-server
    env:
      PPSPY_API_KEY: "{{PPSPY_API_KEY}}"

Technical Analysis

The Skill instructs the host to retrieve ppspy-mcp-server@1.0.1 from the configured npm registry, install it globally, and execute the resulting command. The package implementation, source repository, cryptographic integrity value, and build provenance are not included in the audited project, so its installation and runtime behavior cannot be verified from the supplied artifact.

Pinning the dependency to version 1.0.1 limits version drift but does not verify that the downloaded artifact is trustworthy. npm packages may run lifecycle scripts during installation. After installation, the package is launched with PPSPY_API_KEY in its process environment. Consequently, a malicious or compromised package artifact could execute commands during installation or runtime and read or transmit that credential.

Global installation also expands the package's effect beyond an isolated project directory. The actual privileges available depend on the account running npm and the MCP server; the reviewed file does not explicitly request elevation.

Attack Path

1. An attacker compromises the specified npm package release, its publisher account, the configured npm registry, or another relevant package in its dependency chain.
2. Skill installation runs npm install -g ppspy-mcp-server@1.0.1.
3. npm downloads the affected package and dependencies; app ...[truncated 1150 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish and reference the authoritative source repository and reproducible build information for ppspy-mcp-server.
2. Verify the package tarball against a trusted cryptographic digest or signed provenance before installation.
3. Audit the package, its transitive dependencies, and all npm lifecycle scripts before deployment.
4. Avoid global installation. Install the dependency in a dedicated, locked project environment and execute the verified local binary.
5. Use a lockfile or equivalent immutable dependency manifest that records integrity hashes for the complete dependency graph.
6. Disable npm lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps.
7. Run the MCP server under a dedicated, unprivileged account or sandbox with restricted filesystem and network access.
8. Supply a narrowly scoped, revocable PPSPY API key with appropriate quota and billing controls. Rotate it immediately if package compromise is suspected.
9. Permit outbound traffic only to documented PPSPY API endpoints if the runtime environment supports network allowlisting.
10. Avoid installing the package with root or administrator privileges and monitor the package process for unexpected file access, child processes, and network destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md

---
name: ppspy
description: Search and analyze Shopify stores, Facebook ads, ad monitoring, and sales tracking using PPSPY e-commerce intelligence API. Find winning products, spy on competitors, monitor ad campaigns, and track real-time sales.
version: 1.0.0
metadata:
  openclaw:
    requires:
      env:
        - PPSPY_API_KEY
      bins:
        - npm
    install:
      command: npm
      args:
        - install
        - -g
        - "ppspy-mcp-server@1.0.1"
    primaryEnv: PPSPY_API_KEY
    emoji: "🔍"
    homepage: https://www.ppspy.com
    mcpServers:
      ppspy:
        command: ppspy-mcp-serv

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

## Setup

1. Visit the official website at [ppspy.com](https://www.ppspy.com/) to view real-time dashboard data and product UI.
2. Visit the direct API site at [api.ppspy.com](https://api.ppspy.com/) to get your API key and manage billing/recharge.
3. Set the environment variable: `PPSPY_API_KEY`

## Available Tools (58 total)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes many state-changing and quota-consuming operations such as creating, editing, canceling, stopping, and deleting monitoring tasks and groups, but it does not warn users that these actions modify the remote PPSPY account and may consume paid credits or monitoring quota. In an agent setting, this increases the risk of unintended remote side effects, billing impact, and accidental deletion or disruption of monitoring configurations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.