Used Price Compare

• Outcome: Review
• Latest audit: May 28, 2026 · 8:56 AM UTC
• Version: 0.6.4

Overview

This is a real price-comparison skill, but it uses logged-in browser sessions and can silently manage local bb-browser state in ways users should review first.

Install only if you are comfortable with it using your active browser session for supported marketplace searches, writing bb-browser adapters under your home directory, and restarting bb-browser if the daemon disconnects. Use a separate browser profile or signed-out session for privacy-sensitive shopping, and enable the vision API only when you are comfortable sending listing photos and descriptions to the configured provider.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except Exception:
        pass

    subprocess.run(["pkill", "-f", "bb-browser"], capture_output=True)
    time.sleep(1)
    try:
        subprocess.Popen(

• Confidence: 96% confidence
• Finding: subprocess.run(["pkill", "-f", "bb-browser"], capture_output=True)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The adapter explicitly sends the request with `credentials: 'include'`, which causes the user's Amazon cookies/session state to be attached. That means a seemingly simple search action is performed in an authenticated browser context, potentially exposing account-linked state such as location, Prime eligibility, personalized pricing, or other session-derived data to the skill workflow without explicit user awareness. In a marketplace-comparison skill, this is more dangerous because the code also inspects delivery-region and currency settings, confirming that account/session data is being relied on.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The adapter performs Amazon requests with `credentials: 'include'`, causing the user's authenticated browser session cookies to be sent even though the skill is described as a read-only marketplace search. That expands the privilege of the action beyond anonymous search and can expose account-scoped state such as personalized pricing, delivery location, or login-gated content without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The adapter fetches `args.url` directly with no validation that the host is actually an eBay domain. That enables server-side/request-context URL fetching to arbitrary destinations, and because credentials are included, it can expose authenticated data or be used to reach unintended internal or privileged endpoints. In a price-comparison skill, this is more dangerous because URLs are naturally user-controlled and likely to be supplied frequently.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The metadata claims the adapter is limited to eBay domains, but the implementation never enforces that boundary. This mismatch creates a trust failure: callers, reviewers, or policy engines may assume the code only contacts eBay while it can in fact be used against any host, broadening the attack surface significantly.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The adapter performs a read-only public marketplace search but explicitly sends the request with `credentials: 'include'`, causing ambient browser cookies and session state for ebay.ca to be attached unnecessarily. This expands the trust boundary: a simple search skill can trigger authenticated requests, exposing account-linked state to the remote site, increasing tracking/privacy risk, and potentially causing different behavior based on the user's logged-in session.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The adapter performs a cross-site fetch to a user-supplied Gumtree URL with `credentials: 'include'`, which causes ambient cookies and other authenticated browser state to be sent. For a read-only scraper, this is unnecessary and expands the request from public page retrieval into an authenticated action surface, potentially exposing account-specific data or enabling unintended authenticated requests if the URL handling is ever bypassed or broadened.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill silently writes adapter files into ~/.bb-browser/sites and kills/restarts a local daemon, which exceeds the expected read-only behavior of a price-comparison tool. In an agent context, undisclosed host modification increases trust and safety risk because simply asking for product comparison can mutate the user's environment and disrupt other sessions.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill has host-level process-killing behavior unrelated to its declared purpose of evaluating used-item listings. In context, this makes the skill more dangerous because a marketplace comparison tool should not disrupt local processes; if misused, it can cause denial of service or terminate unrelated automation using the same process name.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The code copies adapter JavaScript files into `~/.bb-browser/sites/`, modifying persistent user-local state that is not disclosed by the manifest. This broadens the skill's effects beyond transient price fetching and creates a supply-chain and persistence surface if adapters are changed or replaced.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad everyday shopping terms such as 'cheapest', 'worth it', and 'trustworthy', which can cause the skill to activate in many normal conversations. Over-broad activation increases the chance that a powerful skill with shell/network behavior runs unexpectedly, exposing browsing, command execution, or data access in contexts where the user did not clearly request it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The fetch call sends browser credentials (`credentials: 'include'`) to an attacker-controlled `args.url` without any visible validation that the URL is actually an Amazon origin. In this skill context, that can cause authenticated cookies or session-bound requests to be sent to arbitrary destinations if a crafted URL is provided, which is especially risky because the skill is intended to fetch marketplace pages and may run in a logged-in browser session.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This file performs an authenticated request to Amazon using the browser session but provides no in-file warning, consent check, or guardrail before doing so. Users may believe they are running a neutral price lookup, while the request actually leverages their logged-in Amazon context, which can change results and expose account-associated preferences or state. In the context of a cross-platform used-price comparison skill, hidden authenticated browsing undermines user expectations of passive, low-risk querying.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code silently includes browser credentials in the network request but neither the metadata nor returned output informs the user that their Amazon session will be used. This creates a transparency and consent problem: a user invoking a simple price comparison may unknowingly expose account-context data to the skill's operation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The request uses `credentials: 'include'` on a fully user-supplied URL, causing ambient authentication material to be sent along with requests where available. Combined with the lack of host restriction, this can leak session-bound data to unintended destinations or let an attacker induce authenticated requests to sensitive sites. The marketplace-detail context does not justify broad credential forwarding, so this makes the issue more dangerous rather than less.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code performs a cross-site request to eBay with `credentials: 'include'`, which causes the browser to attach the user's eBay cookies if present. That unnecessarily discloses authenticated state to a third party during a search operation and can trigger account-linked behavior, tracking, personalization, or unintended actions under the user's logged-in session without clear disclosure or consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill silently sends the user's ambient Gumtree credentials during the HTTP request without any disclosure, even though the capability is described as read-only listing detail retrieval. This increases privacy and security risk because users and calling agents may assume only public scraping occurs, while the request actually operates in the user's authenticated session context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code performs a cross-origin fetch to Gumtree with `credentials: 'include'`, which causes any ambient browser cookies for `www.gumtree.com` to be sent automatically. That can disclose the user's logged-in session state to the skill without clear user awareness and may change the response from anonymous public results to personalized or account-scoped content, increasing privacy and session-handling risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The adapter performs a fetch to a fully user-controlled URL with `credentials: 'include'`, causing browser cookies or other ambient credentials for matching origins to be sent automatically. In a skill that accepts arbitrary full URLs, this can unintentionally authenticate requests to attacker-chosen or sensitive OK.com endpoints, enabling authenticated scraping, privacy leakage, or confused-deputy access beyond what the user expected from a read-only price lookup.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code can terminate and restart bb-browser without any user-facing disclosure or confirmation. In a skill whose stated purpose is marketplace comparison, hidden process control is dangerous because it can disrupt unrelated activity, conceal side effects, and erode user control over the host environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The adapter installer writes files into the user's home directory under ~/.bb-browser/sites with no explicit user approval. For an agent skill, silent persistence on disk is a meaningful safety issue because it changes the local environment and may affect future bb-browser behavior beyond the current request.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The code sends listing title, description, price, condition, and downloaded images to a third-party vision API when enabled, but this file shows no consent gate, warning, or data-minimization control before external transmission. In a price-comparison skill, marketplace listings and images may contain personal information, seller identifiers, or sensitive metadata, so silent transfer to an external model provider creates a real privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad enough to match common shopping language, which can cause the skill to activate when the user did not clearly request cross-platform comparison. Unintended activation can expose user queries to unnecessary marketplace searches, produce misleading automation, and interfere with safer or more appropriate skills handling the request.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The intent routing maps ambiguous phrases like 'cheapest' or a bare product name directly into the compare flow without enough boundary checks. In an agent setting, ambiguous routing can trigger external search actions on incomplete or unintended requests, increasing the chance of privacy leakage, incorrect task execution, or prompt-confusion across overlapping shopping skills.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that listing images are sent to an external OpenAI-compatible vision API, but it does not present a prominent user-facing warning or explicit consent step before third-party transmission. This can expose personal or sensitive data embedded in marketplace photos, especially if images contain addresses, serial numbers, faces, invoices, or other identifying details.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.