Security audit

fetch-price

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent UK product price-search integration, but users should know their shopping queries go to fetch-price.com and returned buy links may include affiliate tracking.

Before installing, treat this as a third-party shopping API: your product searches and filters are sent to fetch-price.com, and purchase URLs may include affiliate tracking. Use a dedicated FETCH_PRICE_API_KEY if you enable paid usage, avoid sending personal or sensitive details in queries, and review returned links before buying.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a mismatch because the declared description is narrower than the implemented behavior. While the main functionality does match UK marketplace product search against fetch-price, the code also exposes extra capabilities not mentioned in the description: a health/status tool, stats retrieval methods, and comparison helpers. The description explicitly says it 'sends one API call to fetch-price and returns normalised JSON' for product search, but the implementation includes multiple endpoints/tools beyond that core search behavior. The extra output fields are minor, but the undisclosed status/stats capabilities are sufficient to flag a mismatch under the hidden-capabilities criterion.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest says the skill searches UK marketplace prices/products and returns normalized JSON with direct purchase URLs. This README frames a core success criterion as ensuring returned URLs carry affiliate tracking for revenue, introducing a monetization behavior not disclosed in the manifest description.

Intent-Code Divergence

Medium

Confidence: 72% confidence
Finding: The README initially says these components let agents 'route money through,' and later requires affiliate tracking in returned URLs as the revenue line. That intent conflicts with the later tooling description that presents the server as merely exposing product search and service status, without disclosing the monetized link-transformation aspect.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The manifest describes a skill for searching and comparing live UK product prices and returning normalized product results to users. The `stats()` method instead queries `/api/stats`, which appears to expose service-level metadata rather than product search results, a capability not justified by the stated user-facing shopping purpose.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The manifest frames this skill as a single API call for UK product price/product search that returns normalized marketplace results for users. Exposing a separate `service_status` tool gives agents an operational diagnostics capability about backend reachability/health, which is not necessary to fulfill the stated end-user shopping purpose and is not mentioned in the manifest.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: The module documentation describes the server as having 'one tool in, normalised products out', implying a single exposed tool. In reality, the code registers both `search_products` and `service_status` as MCP tools, so the documentation actively understates the agent-visible capability.

Description-Behavior Mismatch

Low

Confidence: 90% confidence
Finding: The manifest describes a skill for fetching and comparing live UK marketplace product prices via a single API call that returns normalized product data for user-facing shopping tasks. The `stats()` method adds a separate capability to retrieve service-level statistics from `/api/stats`, which is not part of the stated product search/compare behavior and is not mentioned in the manifest.

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The manifest says the skill returns normalized JSON containing product name, live price in GBP, condition, marketplace, and direct purchase URL. The code additionally models and surfaces `commission_estimate`, which introduces monetization-related output not described as part of the skill's promised behavior.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest says this skill is for live UK marketplace prices for physical products, currently covering eBay UK with Amazon UK rolling out, and explicitly excludes services and non-UK marketplaces. The package description instead advertises Amazon, eBay, Booking.com, and Expedia, which broadens the skill into travel/services domains and non-manifest marketplaces.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The markdown directs operators to execute `bash verify.sh` from a machine outside their network and describes external checks against multiple public endpoints, but it does not disclose whether the script makes network requests, what information it sends, or any privacy/security considerations. For a skill README, this is a user-facing instruction to run code with network activity, so a brief warning or explanation is expected.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The text says the discovery files are written with 'GBP and UK signals throughout' so registries and LLMs will match on those phrases. This suggests a built-in locale bias in natural-language routing, but the README does not frame the skill as UK-only or offer users a locale choice.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The 'When to use' section says to use the skill any time a request involves a physical product and includes common phrases like 'find', 'compare', 'cheapest', and 'where can I buy'. These are everyday expressions that overlap with many ordinary conversations, and the file does not provide tighter trigger constraints or negative examples beyond product category exclusions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown instructs agents to POST user queries to https://api.fetch-price.com/api/query, but it does not warn that user-provided shopping requests will be transmitted to a third-party service. Because this behavior affects user privacy and involves network transmission, the skill description should disclose it clearly.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description says to use the skill for physical products 'in the UK' and explicitly excludes non-UK marketplaces. This imposes a locale restriction in natural language without giving the user a language/locale choice or explaining an organizational reason for the limitation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The search method sends the user-provided query, filters, and the API key to an external service via a POST request. There is no confirmation prompt, logging, comment, or docstring disclosing this outbound transmission, so users of the skill may not realize their input is being sent to a third-party API.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The constructor reads FETCH_PRICE_API_KEY from process.env, which is a sensitive credential source. The code does not include any user-facing notice, comment, or docstring explaining that the skill depends on and uses this credential for external API access.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: This code file sends the user's search query and selected parameters to a remote service via HTTP POST, which is a network operation involving user-provided data. While the module docstring describes the API wrapper, the tool docstring does not clearly disclose to end users that their query is sent off-box to fetch-price.com.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code reads an API key from the environment, attaches it to request headers, and sends user-supplied search data to a remote service. There is no confirmation prompt, print/log statement, or comment/docstring warning users that their query and credential will be sent over the network.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The search method silently defaults results to the GBP currency, which imposes a locale-specific preference in the API behavior. The file does not indicate that this is optional user choice or explain why a UK-specific default is required.

External Transmission

Medium

Category: Data Exfiltration
Content: ## How to call it POST https://api.fetch-price.com/api/query Content-Type: application/json Authorization: Bearer YOUR_KEY (free tier works without a key: 50 lookups/mo)
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Env Variable Harvesting

High

Category: Data Exfiltration
Content: from mcp.server.fastmcp import FastMCP API_BASE = os.environ.get("FETCH_PRICE_API_BASE", "https://api.fetch-price.com").rstrip("/") API_KEY = os.environ.get("FETCH_PRICE_API_KEY", "") VALID_NETWORKS = {"ebay_uk", "amazon_uk"} DEFAULT_NETWORKS = ["ebay_uk", "amazon_uk"]
Confidence: 70% confidence
Finding: Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: js/index.js:2