Security audit

openclaw-ecommerce

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its e-commerce purpose, but it contains under-scoped maintenance and price-checking code that should be reviewed before installation.

Install only if you are comfortable with local storage of product and order data, outbound requests to product URLs, and review-level maintenance code. Avoid scheduling price checks until the missing/out-of-package imports and URL validation are fixed, and do not use backup or restore with sensitive data unless paths and file provenance are tightly controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises local-first e-commerce functionality but does not declare network permissions despite relying on a generic price scraper and remote order/status lookups. Hidden network capability weakens user consent and reviewability, and could enable unexpected outbound requests or data exposure if the implementation fetches URLs or sends tracked data externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The documented behavior omits materially significant capabilities: full database backup/restore, writing interchange markdown outside the private local store, and persistence of circuit-breaker state for remote fetches. This mismatch is dangerous because users and reviewers may approve the skill for simple price tracking while it also performs broader data movement and persistence operations that could expose business/order data or expand the attack surface.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The restore function deletes all existing rows from multiple tables and replaces them with data from an arbitrary backup file. In an agent skill whose stated purpose is price monitoring, order tracking, and margin analysis, destructive restore capability is outside the expected operational scope and creates a serious integrity risk if invoked accidentally or by a malicious caller.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The module accepts caller-controlled filesystem paths for both backup output and restore input, enabling arbitrary file write and read behavior relative to the process's permissions. This is dangerous because an agent or untrusted caller could exfiltrate database contents to unintended locations or read attacker-chosen files masquerading as backups, which is broader than justified by the skill's e-commerce functionality.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill stores order and product data locally and publishes markdown files for other agents, but the description lacks a clear warning about this sharing behavior. In an e-commerce context, product lists, costs, tracking numbers, and margin data can be commercially sensitive, so silent publication to agent-consumable files increases the risk of unintended disclosure or secondary misuse.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The backup operation writes a plaintext JSON file containing full database contents, including orders, alerts, and operational state, without any warning, consent, or protection. In this skill context, that creates unnecessary data exposure risk because monitoring/tracking data may be silently persisted to disk where other users, processes, or backups can access it.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The restore path clears existing tables before verifying that the incoming dataset is complete, valid, and safe, with no confirmation step. This can cause irreversible loss or corruption of product, order, and history data from a malformed or malicious backup file, making the behavior especially dangerous in a skill that should primarily analyze and track data rather than overwrite it wholesale.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The function fetches an arbitrary URL passed into the skill with no allowlist, scheme validation, or network boundary checks. In an agent context, this can be abused for SSRF-style access to internal services, metadata endpoints, or unintended outbound requests, making it more dangerous than a normal e-commerce scraper.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal