Security audit

Store Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches store onboarding, but it includes unsafe credential transport guidance and destructive password-reset commands that warrant careful review before use.

Use this skill only if you are comfortable with an agent handling store admin credentials. Prefer HTTPS or a trusted tunnel for any non-localhost admin or MCP access. Do not run the password-reset deletion commands casually; back up the datastore, isolate the service from LAN/Internet access first, and complete the setup immediately afterward.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:220
Finding: Administrative Credentials and Bearer Tokens May Be Transmitted over Unencrypted LAN HTTP
Content: View full analysis
/admin` (e.g., `http://192.168.1.100/admin`) For native binary install (default port 5102): - **Same machine**: `http://localhost:5102/admin` - **Other devices on LAN**: `http://:5102/admin` ### Onboarding Steps The Setup Wizard is identical to VPS Standalone mode (Steps 1-4 above). The only differences: - **No domain needed** — You access via `localhost` or LAN IP - **No HTTPS** — Local connections use HTTP (this is fine for LAN) - **MCP connects directly** — No SSH tunnel needed; use SSE at `http://localhost:5102/platform/v1/mcp/sse` ``` The same insecure HTTP access model is repeated in `references/access-modes.md`, including the local administrator and MCP URLs. ### Technical Analysis The skill directs users to perform the standalone onboarding workflow over plaintext HTTP when accessing a store from another LAN device. That workflow includes submitting the administrator password, requesting a bearer token, and using that token for subsequent privileged API requests. HTTP provides neither transport confidentiality nor server authentication. Treating HTTP as safe merely because it is used on a LAN is an unsafe assumption. A malicious or compromised LAN participant, wireless access point, router, proxy, or other network device may observe credentials and bearer tokens. An active attacker may also alter responses or redirect the user to a spoofed administration interface. Loopback-only HTTP has a narrower exposure, but the documented addresses explicitly permit access from other LAN devices. ### Attack Path 1. The operator opens `http:///admin` ...[truncated 949 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:252
Finding: Database-Deletion Password Recovery Reopens an Unauthenticated Administrator-Claim Race
Content: View full analysis
**Warning**: This resets the admin password only. Store data (products, orders) is preserved, but you will need to re-set your admin password via the Setup Wizard. ``` The setup behavior enabling the race is documented earlier in `SKILL.md`, lines 97-106: ```markdown POST /v1/system/setup Content-Type: application/json { "password": "" } ``` This endpoint is **public** (no auth required) and can only be called **once**. After the password is set, all endpoints require authentication. ``` ### Technical Analysis The recovery process removes the authentication database and restarts the service. According to the skill, this causes the public, unauthenticated setup endpoint to become available again. Because the first caller can set the administrator password and the endpoint can only be called once, recovery creates a race to claim administrator access. The instructions do not require the service to be isolated from the network while the database is deleted and setup is re-enabled. This is particularly dangerous for VPS deployments exposed through a public IP or domain, but it can also be exploited by another participant on a local network. Deleting an entire database is also a destructive recove ...[truncated 1789 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This native-host command performs an unconditional local file deletion in the user's home directory and restarts the service, which is a high-risk action for an agent to execute. On a host system, such commands are especially dangerous because path expansion and context errors can lead to unintended destructive effects, loss of access, or broader system disruption.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
For native binary:

bash
rm -f ~/.mobazha/datastore/mainnet.db mobazha service stop && mobazha service start

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
md
**Recommended next steps** (tell the user about these): 1. **Configure payment methods** — `/admin/settings/payments` to enable crypto wallets and/or fiat providers (Stripe, PayPal) 2. **Add your first product** — `/admin/products/new` to create a listing 3. **Customize your storefront** — `/admin/settings/storefront` to adjust theme and branding 4. **Set up a domain** — If not done during deployment, see the `subdomain-bot-config` skill 5. **Connect an AI agent** — See the `store-mcp-connect` skill to let your AI agent manage the store directly

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is scoped to first-time onboarding, but it includes destructive recovery instructions that delete the authentication database to reset the admin password. In an agent context, this expands the skill beyond onboarding into system-modifying recovery actions, creating risk of accidental service disruption, forced credential reset, and unauthorized lockout if invoked without strong confirmation and scope checks.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

Low

Category: Tool Misuse
Confidence: 84% confidence
Finding: The command deletes the datastore authentication DB inside the container, which is a destructive filesystem operation an agent could execute if it follows the skill verbatim. Although framed as password recovery, exposing raw deletion commands in a general-use skill increases the chance of parameter misuse, accidental execution, and service impact.
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
bash
cd /opt/mobazha docker compose exec mobazha rm -f /data/datastore/mainnet.db docker compose restart mobazha

Static analysis

No suspicious patterns detected.