publish test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:06 AM UTC
• Version: 1.0.0

Overview

The skill’s shopping-search purpose is coherent, but installing it runs an unpinned third-party npm MCP package whose reviewed code is not included.

Review this carefully before installing. The shopping-search behavior itself fits the description, but run the MCP server only in a restricted environment, avoid confidential procurement searches or internal-only product URLs unless approved, and prefer a pinned reviewed package version instead of the unpinned npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Automatic Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32-38
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json

{
  "mcpServers": {
    "cn-ecommerce-search": {
      "command": "npx",
      "args": ["-y", "@shopmeagent/cn-ecommerce-search-mcp"]
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with the -y option and a package name that has no exact version constraint. This causes npm to resolve, download, and execute the package version available from the configured registry at invocation time. The -y option automatically accepts installation prompts.

Consequently, the code executed by users can change after the Skill has been reviewed. The configuration also provides no integrity hash or other mechanism for verifying that the downloaded package is the exact artifact that was audited. If the package, its transitive dependencies, its publisher account, or the package registry is compromised, attacker-controlled lifecycle scripts or runtime code could execute locally.

The audited project contains only SKILL.md; the implementation of @shopmeagent/cn-ecommerce-search-mcp is not included. Therefore, this finding concerns unsafe dependency acquisition and execution rather than evidence that the current package version is malicious.

Attack Path

1. An attacker compromises the npm publisher account, package release process, registry delivery path, or a transitive dependency associated with @shopmeagent/cn-ecommerce-search-mcp.
2. The attacker publishes or causes resolution of a malicious package version.
3. A user applies the documented MCP configuration and starts the server.
4. npx -y resolves and downloads the then-current package without an interactive confirmation or an exact version pin.
5. Malicious installation lifecycle scripts or package runtime code execute with the permissions of the user running the MC ...[truncated 930 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a specific, reviewed version, for example:

   json

   {
     "mcpServers": {
       "cn-ecommerce-search": {
         "command": "npx",
         "args": ["-y", "@shopmeagent/cn-ecommerce-search-mcp@2.0.0"]
       }
     }
   }
   

2. Prefer a reproducible installation workflow using a committed lockfile and npm integrity metadata rather than resolving the package dynamically on every invocation.
3. Verify package provenance, publisher identity, release signatures or attestations, and dependency contents before approving version updates.
4. Review lifecycle scripts and transitive dependencies, and disable installation scripts where they are not required.
5. Remove automatic confirmation where practical so unexpected downloads are visible to the operator.
6. Run the MCP server in a restricted environment with minimum filesystem permissions, a sanitized environment, no unnecessary credentials, and outbound network access limited to required endpoints.
7. Establish a controlled update process in which each new package version is scanned and reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly routes user product searches and URLs through a third-party Shopme API/database, but the user-facing description does not clearly disclose that potentially sensitive shopping interests, supplier research, or private product links are transmitted off-platform. This creates a privacy and data-handling transparency issue: users may share URLs, identifiers, or procurement queries assuming local processing or first-party handling when that is not the case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.