Vigilath Pet Commerce

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 1.0.0

Overview

This shopping skill is not malicious, but it needs review because it can automatically create and pay for orders with account points without a required final confirmation.

Install only if you intend to let an agent use a Vigilath account token for shopping actions. Require the agent to show and confirm the exact products, quantities, total price, shipping address, and payment method before every order and before every payment. Avoid autonomous: true and points payment unless you have explicit spending limits and pre-approval rules.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:192

Finding

Purchases and Points Payments Lack an Explicit Transaction Approval Gate

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:145-151 and SKILL.md:192-196
Vulnerability Type: Missing authorization checkpoint for financially consequential actions
Risk Level: High

Vulnerable Code Snippets

SKILL.md:145-151:

markdown

Methods:
- `points` — instant settlement, fully automated
- `stripe` — returns `paymentUrl`, show to user to complete card payment
- `coinbase` — returns `paymentUrl`, show to user to complete crypto payment

After stripe/coinbase, poll order status to confirm payment.

SKILL.md:192-196:

markdown

4. Pay: `POST /api/agent/pay` with orderNumber

### Quick buy (autonomous — one call)
1. `POST /api/agent/shopping` with `autonomous: true` — AI picks and orders automatically
2. Pay: `POST /api/agent/pay` with orderNumber from response

Technical Analysis

The documented autonomous workflow allows the remote service to select products and create an order, after which the agent is instructed to submit the resulting order number for payment. The points payment method performs instant, fully automated settlement.

The Skill does not require a transaction-specific user confirmation immediately before order creation or payment. In particular, it does not require the agent to present and confirm the final products, quantities, total price, shipping address, bargain quote, and payment method.

This violates the security principle that financially consequential and potentially irreversible operations must require explicit approval based on the final transaction details. General permission to shop should not be treated as authorization for an unspecified purchase or payment.

Stripe and Coinbase payments still require the user to visit an external payment URL, limiting automatic settlement for those methods. The directly documented automatic financial risk applies primarily to account points.

Attack Path

1. The authenticated agent receives ...[truncated 1473 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, transaction-specific user confirmation immediately before every order is created.
2. Require a separate explicit confirmation immediately before any payment or points settlement.
3. Present the complete final transaction summary before confirmation, including:
   • Product names and identifiers
   • Quantities
   • Unit and total prices
   • Discounts or bargain quotes
   • Shipping address
   • Payment method
   • Points or currency amount to be charged
4. Disable autonomous: true by default. Permit it only after explicit opt-in with clearly defined product, quantity, price, and spending constraints.
5. Do not interpret general requests such as “buy pet food” as authorization to settle payment.
6. Add configurable per-order and cumulative spending limits for autonomous operations.
7. Require reconfirmation whenever the product, quantity, price, address, or payment method changes after approval.
8. Use idempotency keys for order and payment requests to prevent duplicate charges caused by retries.
9. Return a non-settling payment preview before committing points and require a distinct confirmed commit operation.
10. Record an audit trail containing the displayed transaction details and the corresponding user approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation explicitly enables placing orders and making payments, including points payments described as 'instant settlement, fully automated,' without requiring user confirmation. In an agent setting, this can cause unauthorized purchases or irreversible spending if the skill is triggered by ambiguous prompts, prompt injection, or mistaken product selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The autonomous workflow says AI can 'pick and order automatically' in one call, but it omits a warning about the consequences of delegating product choice and order placement. That omission materially raises the risk of unintended purchases, especially when combined with later payment flows and bargain sessions that may further commit the user financially.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

env:
        - VIGILATH_TOKEN
      bins:
        - curl
    primaryEnv: VIGILATH_TOKEN
---

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The shopping example hard-codes "language": "English", and the bargaining guidance mixes fixed English and Chinese phrases as supported inputs without stating that language choice is optional or user-controlled. This can be read as imposing a language/locale behavior rather than offering a choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents an autonomous: true shopping mode that lets AI select and order products automatically, but this high-risk behavior is not disclosed in the manifest description. Hidden or under-disclosed autonomy increases the chance that an orchestrating agent or user enables purchasing authority without understanding that product selection and order placement may occur without an explicit approval step.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest frames the skill as searching, bargaining, ordering, and paying for pet supplies on Vigilath.com, which clearly covers commerce actions. However, the documentation additionally exposes payment orchestration via Stripe and Coinbase payment URLs, extending the skill into broader payment handling beyond a narrowly described shopping assistant.

Content

No source excerpt is available for this finding.