Security audit

fetch-price

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised price search, but its purchase links appear monetized through affiliate tracking that is not clearly disclosed in the main skill listing.

Review this before installing if affiliate monetization matters to you. The price-search behavior is straightforward, but returned purchase URLs may include affiliate tracking, user search terms are sent to fetch-price.com, and install dependencies are not pinned. Use a separate environment, keep FETCH_PRICE_API_KEY private, and avoid sending sensitive personal details in product queries.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:22
Finding: Unpinned Third-Party Dependencies in Installation Instructions
Content: View full analysis
Remediation: View remediation
" "httpx==" ``` 2. Maintain a lock file or hash-verified requirements file containing all direct and transitive dependencies: ```text mcp[cli]== \ --hash=sha256: httpx== \ --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate dependency artifacts in a controlled build process and commit the reviewed lock data to the repository. 4. Add automated dependency vulnerability and provenance checks, such as `pip-audit`, release-signature verification where available, and alerts for dependency updates. 5. Review and test dependency upgrades before changing pins. Update the command in both `README.md` and `mcp/fetch_price_mcp.py` so the two installation instructions remain consistent. 6. Advise operators to install the MCP server in an isolated virtual environment under a non-privileged account rather than using system-wide or administrative installation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the implementation supports undeclared stats access, generic networks/currencies, or extra fields such as commission estimates, then the skill exceeds its stated UK-only, normalized-search contract. This can mislead agents into sending broader queries or presenting data with hidden commercial or geographic assumptions, increasing privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: If the implementation supports undeclared stats access, generic networks/currencies, or extra fields such as commission estimates, then the skill exceeds its stated UK-only, normalized-search contract. This can mislead agents into sending broader queries or presenting data with hidden commercial or geographic assumptions, increasing privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly frames the skill as a mechanism to 'route money through' agents and prioritizes affiliate tracking in returned purchase URLs as a core success criterion. That creates a meaningful mismatch between the manifest's user-facing price-search purpose and the documented monetization behavior, increasing the risk of undisclosed commercial redirection and deceptive tool use by downstream agents or operators.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The text explicitly says the discovery assets are written with 'GBP and UK signals throughout' and emphasizes user phrasings like 'under £100' to drive routing. This pushes a specific locale in the skill description without presenting it as an optional or clearly justified region-specific mode, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill performs network access and may rely on environment-provided credentials, but it does not declare any explicit tool scope or permissions boundary. In agent environments, missing scope declarations can cause overbroad execution authority, make review harder, and increase the chance that the skill is invoked with capabilities the user or host did not intend.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'When to use' section activates the skill for very common phrases like 'find', 'compare', and 'where can I buy', and adds the broad heuristic 'Any time' plus 'If the user would otherwise open eBay or Amazon'. Although the file includes some exclusions, the trigger scope remains broad enough to overlap with everyday shopping-related requests without explicit negative examples or tighter activation constraints.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This skill makes an outbound request to an external domain, which is an expected capability for price lookup but still carries real data-exposure risk. Any user-supplied search terms, filters, or embedded personal details are transmitted off-platform, and the direct-buy URL output may also influence user actions based on third-party content.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
## How to call it POST https://api.fetch-price.com/api/query Content-Type: application/json Authorization: Bearer YOUR_KEY (free tier works without a key: 50 lookups/mo)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs agents to send user queries to an external API but does not include a clear user-facing disclosure about that transmission. In an agent context, users may unknowingly share shopping intent, product interests, or potentially sensitive query text with a third party, creating privacy and consent issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill sends raw user product queries and optional price constraints to an external third-party API, which creates a privacy and data-governance risk if users are not clearly informed that their inputs leave the local agent environment. In an agent setting, users may include sensitive preferences, health-related products, or other personal information in shopping queries, so undisclosed transmission can violate expectations and organizational policy even if the code is otherwise straightforward.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a narrowly scoped skill for searching live UK marketplace products and prices and returning normalized product data for buying decisions. The stats() method instead exposes a separate /api/stats capability, which is not part of finding, comparing, or price-checking products and is not justified by the stated purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The package metadata describes a broader commerce capability than the skill manifest, including Amazon, Booking.com, and Expedia, while the stated skill scope is limited to UK physical product price search. This scope mismatch can mislead reviewers, downstream agents, or deployment tooling about what the skill is intended to access and increases the risk of unauthorized use outside the declared boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The verification section treats successful pip install fetch-price and npm install fetch-price resolution as current claims being tested, but later the README candidly states the PyPI/npm packages may not actually exist yet. That is an active documentation contradiction about whether installable packages are presently available.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The markdown file includes a configuration example that uses FETCH_PRICE_API_KEY, which is a sensitive credential, but it does not include any warning or handling guidance about storing, sharing, or exposing that key. Under the markdown-specific warning criterion, credential-related behavior should be disclosed when it could affect user privacy or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The constructor reads FETCH_PRICE_API_KEY from the environment and fails if it is absent, but the file does not include any comment, docstring, or other user-facing notice that the skill depends on a credential. Under the code-file warning criteria, access to sensitive credentials should have some form of disclosure unless documented elsewhere.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest context describes a narrowly scoped skill for finding and comparing live UK marketplace prices and returning normalized product data. In contrast, the package description frames the project as an 'Agent-native marketplace for affiliate commerce', suggesting a commerce/affiliate monetization function rather than just neutral price retrieval.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes this skill as sending one API call to fetch-price to return normalised product pricing results for user shopping tasks. The code also exposes a separate service_status MCP tool that queries API health, which is operational functionality not described in the manifest's user-facing scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The constructor reads FETCH_PRICE_API_KEY from the environment and attaches it to outbound request headers, but the file provides no comment, docstring, or other visible warning that credentials are being accessed and used. Access to sensitive environment variables is in scope for missing-warning review on code files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The search method sends the user-provided query and filters to a remote API via POST, but this file includes no confirmation prompt, logging, comment, or docstring disclosing that input data is transmitted off-host. For a code file, remote transmission of user data is a safety-relevant operation that should have some visible disclosure unless documented elsewhere in skill markdown.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: js/index.js:2