Whop Store Management

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:05 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Whop store-management helper, but users should treat its API key and global npm install as sensitive setup steps.

Install this only if you intend to let an agent help operate your Whop account. Use a least-privileged Whop API key where possible, keep it out of commits and shared logs, and consider replacing the global unpinned npm install with a pinned project-local dependency before using it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

yaml

install:
  - id: npm-sdk
    kind: command
    command: "npm install -g @whop/sdk"
    label: "Install Whop SDK"

Technical Analysis

The skill instructs the environment to install the latest available version of @whop/sdk globally. No exact version or package-integrity value is specified, so the code installed at runtime can differ from the code that was present when the skill was audited.

npm installation may execute package lifecycle scripts, including scripts supplied by transitive dependencies. A compromised package release, compromised maintainer account, or malicious transitive dependency could therefore execute code with the privileges of the user running the installation. The -g option also expands the installation scope beyond the project and may require elevated privileges on some systems.

This finding represents supply-chain exposure; the audited file does not establish that the current @whop/sdk package is malicious.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious version.
2. The skill installation command resolves @whop/sdk without a version constraint and retrieves the attacker-controlled release.
3. npm executes any malicious lifecycle script during installation, or the malicious library code executes when imported.
4. The payload operates with the installing user's privileges and can access data and credentials available to that process, potentially including WHOP_API_KEY and WHOP_COMPANY_ID.
5. Because the package is installed globally, modified files or executables may affect other projects or users of the same runtime environment, subject to filesystem permissions.

Impact Assessment

Successful exploitation co ...[truncated 508 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed version, for example @whop/sdk@X.Y.Z, rather than resolving the latest release.
• Prefer a project-local dependency and a committed lockfile over npm install -g.
• Use npm ci with a reviewed lockfile in automated environments to obtain deterministic dependency resolution.
• Verify package provenance and registry configuration, and enforce lockfile integrity hashes.
• Review direct and transitive dependencies before upgrades; use dependency scanning and allowlisting where practical.
• Run installation as a dedicated, unprivileged user in an isolated environment with no production credentials present.
• Where compatible with the package, suppress lifecycle scripts during installation with --ignore-scripts; explicitly review and separately run any scripts that are genuinely required.
• Avoid exposing WHOP_API_KEY and WHOP_COMPANY_ID to dependency installation processes, and grant the API key only the minimum permissions required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

Setup

1. Get API key from Whop dashboard → Settings → Developer
2. Set environment variables:

   bash

   export WHOP_API_KEY="apik_..."
   

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description scopes the skill to managing a Whop digital products store through product, plan, payment, and membership operations. The documentation then advertises many additional SDK resource domains that go well beyond that stated scope, indicating the skill can be used for substantially broader platform access than claimed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file instructs users to obtain and export WHOP_API_KEY and WHOP_COMPANY_ID, but does not include any warning that the API key is sensitive or should be protected from logs, shell history, or accidental sharing. Because the skill involves credential setup and authenticated API access, a brief user-facing warning would improve safety and privacy awareness.

Content

No source excerpt is available for this finding.