Whop Store Management

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:05 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Whop store-management helper, but users should treat its API key and global npm install as sensitive setup steps.

Install this only if you intend to let an agent help operate your Whop account. Use a least-privileged Whop API key where possible, keep it out of commits and shared logs, and consider replacing the global unpinned npm install with a pinned project-local dependency before using it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 13-17 **Vulnerability Type**: Unpinned and globally installed third-party dependency **Risk Level**: Medium ```yaml install: - id: npm-sdk kind: command command: "npm install -g @whop/sdk" label: "Install Whop SDK" ``` ### Technical Analysis The skill instructs the environment to install the latest available version of `@whop/sdk` globally. No exact version or package-integrity value is specified, so the code installed at runtime can differ from the code that was present when the skill was audited. npm installation may execute package lifecycle scripts, including scripts supplied by transitive dependencies. A compromised package release, compromised maintainer account, or malicious transitive dependency could therefore execute code with the privileges of the user running the installation. The `-g` option also expands the installation scope beyond the project and may require elevated privileges on some systems. This finding represents supply-chain exposure; the audited file does not establish that the current `@whop/sdk` package is malicious. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a transitive dependency and publishes a malicious version. 2. The skill installation command resolves `@whop/sdk` without a version constraint and retrieves the attacker-controlled release. 3. npm executes any malicious lifecycle script during installation, or the malicious library code executes when imported. 4. The payload operates with the installing user's privileges and can access data and credentials available to that process, potentially including `WHOP_API_KEY` and `WHOP_COMPANY_ID`. 5. Because the package is installed globally, modified files or executables may affect other projects or users of the same runtime environment, subject to filesystem permissions. ### Impact Assessment Successful exploitation co ...[truncated 508 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, reviewed version, for example `@whop/sdk@X.Y.Z`, rather than resolving the latest release. - Prefer a project-local dependency and a committed lockfile over `npm install -g`. - Use `npm ci` with a reviewed lockfile in automated environments to obtain deterministic dependency resolution. - Verify package provenance and registry configuration, and enforce lockfile integrity hashes. - Review direct and transitive dependencies before upgrades; use dependency scanning and allowlisting where practical. - Run installation as a dedicated, unprivileged user in an isolated environment with no production credentials present. - Where compatible with the package, suppress lifecycle scripts during installation with `--ignore-scripts`; explicitly review and separately run any scripts that are genuinely required. - Avoid exposing `WHOP_API_KEY` and `WHOP_COMPANY_ID` to dependency installation processes, and grant the API key only the minimum permissions required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Get API key from Whop dashboard → Settings → Developer
2. Set environment variables:
   ```bash
   export WHOP_API_KEY="apik_..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description scopes the skill to managing a Whop digital products store through product, plan, payment, and membership operations. The documentation then advertises many additional SDK resource domains that go well beyond that stated scope, indicating the skill can be used for substantially broader platform access than claimed.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This markdown file instructs users to obtain and export `WHOP_API_KEY` and `WHOP_COMPANY_ID`, but does not include any warning that the API key is sensitive or should be protected from logs, shell history, or accidental sharing. Because the skill involves credential setup and authenticated API access, a brief user-facing warning would improve safety and privacy awareness.

Static analysis

No suspicious patterns detected.