fetch-price

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This appears to be a real commerce-routing skill, but it handles affiliate credentials, API keys, and user query data with under-scoped and unsafe controls that require review before installation.

Review this skill carefully before installing or using it. Avoid submitting real affiliate credentials, business-sensitive product searches, or production API keys until the publisher documents data handling and fixes plaintext secrets, unauthenticated registration, raw cross-agent configuration disclosure, and debug-mode deployment risks.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: data/agents.json:33

Finding

Active API Keys Committed in Plaintext

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: api.py:75

Finding

Unauthenticated Registration Creates Immediately Active Agents with Arbitrary Endpoints

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: api.py:175

Finding

Authenticated Agents Can Retrieve Other Agents' Complete Affiliate Network Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: api.py:56

Finding

API Keys Accepted Through URL Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: api.py:287

Finding

Flask Development Debugger Enabled in Application Entry Point

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: api.py:156

Finding

Indefinite Plaintext Retention of Product Query History

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 115)May include surrounding context.

html

</div>
</nav>

<!-- HERO -->
<section class="hero">
  <div class="container">
    <div class="badge">Trade pricing + AI agent commerce</div>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 76% confidence

Finding

The skill advertises executable capabilities with detected file-write behavior but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this can lead to unintended access being granted implicitly, making it harder for orchestrators or users to understand that the skill may write data locally or manipulate files during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation language is broad enough that general product-search requests could match and trigger this skill, causing user queries to be routed to an external affiliate marketplace without clear narrowing conditions. This increases the chance of unintended activation, unnecessary data sharing, and affiliate-driven responses being inserted where the user did not explicitly request external commerce routing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description instructs users to send product queries and agent registration details, including network credentials, to an external API but does not provide a clear warning about that data transfer. In a commerce and affiliate context, this is risky because sensitive business information, query contents, and credentials may be disclosed to a third party without informed consent or adequate handling expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Newly issued agent API keys are stored in plaintext on disk in a JSON file under a root-owned data directory, creating a concentrated secret store with weak protection assumptions. If the host, backups, logs, or file permissions are exposed, attackers can recover valid credentials and impersonate agents against authenticated endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The service persistently logs raw user query text along with requester identity, routed agents, and timestamps without any minimization or consent mechanism. In a product-discovery marketplace, search queries may contain personal, commercial, or sensitive intent data, so unauthorized access to these logs could expose user behavior and business intelligence.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The unauthenticated /api/query/self endpoint exposes the platform’s built-in affiliate-link generation behavior and embedded affiliate identifiers to any caller. In this marketplace context, that broadens public access to internal monetization functionality and allows third parties to harvest or abuse affiliate tags, scrape routing behavior, and generate affiliate search URLs at scale without authorization.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The inline comment explicitly states 'Use SearXNG for price research,' which describes active external search behavior. In reality, the function merely formats affiliate search links for Amazon and eBay and returns them, so the documentation contradicts the implemented behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data/agents.json (reported line 68)May include surrounding context.

json

}
    },
    "commission_split": 0.3,
    "endpoint": "https://api.fetch-price.com/api/self/query",
    "api_key": "fp_c3250ece1fc74de1",
    "status": "active",
    "registered": "2026-07-26T15:41:04.963847",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that routes product queries to agents with affiliate network access. In contrast, large portions of the file advertise auction-to-retail spreads, distressed assets, insolvency alerts, and trade-sector valuation packs, which are a separate business capability rather than an obvious implementation detail of affiliate product query routing.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · index.html (reported line 287)May include surrounding context.

html

<h3>Scale</h3>
          <div class="price">£99<span>/mo</span></div>
          <ul>
            <li>Unlimited queries</li>
            <li>All networks</li>
            <li>White-label API</li>
            <li>Priority support</li>

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The page claims instant API key issuance and immediate onboarding, but the error path says the backend is not yet available and registrations are merely queued. This discrepancy can mislead users into submitting affiliate identifiers and business information under false assumptions, undermining informed consent and trust in how sensitive onboarding data is handled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The form collects affiliate tags and returns API credentials directly into the page without any user-facing warning about sensitive handling, storage, or display risks. Exposing newly issued API keys in rendered HTML increases the chance of accidental disclosure through shoulder-surfing, screenshots, browser extensions, shared devices, or unsafe copy/paste practices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document is explicitly marked with lang="en", and the page content is written only in English, with no indication of language choice or region-specific justification for users. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.