Haresh Checkout Flow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:22 AM UTC
• Version: 1.0.1

Overview

The skill is a checkout assistant, but its instructions may send sensitive checkout data to local webhooks and call payment processing before final user confirmation.

Review this skill carefully before installing. It should be updated so the user reviews and confirms the final order before any payment or order-creation webhook is called, and so it clearly documents what checkout data is sent to n8n, how webhook requests are authenticated, and that only tokenized payment method identifiers are used.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:25
• Finding: Checkout Processing Occurs Before Final User Confirmation## Vulnerability Details **File Location**: `SKILL.md`, lines 25-29 **Vulnerability Type**: Transaction authorization and workflow-ordering flaw **Risk Level**: High **Vulnerable Code Snippet**: ```md ### Step 4: Payment Processing Present payment options and call n8n webhook at http://localhost:5678/webhook/checkout-process ### Step 5: Order Confirmation Display order summary and get final confirmation from user. ``` ### Technical Analysis The workflow instructs the Agent to call the `checkout-process` webhook during Step 4, while explicit final confirmation is not obtained until Step 5. If the webhook performs a payment, creates an order, reserves inventory, or causes another irreversible side effect, the transaction can be initiated before the user has reviewed and authorized the final order. The document does not state that the Step 4 request is limited to a non-mutating preview operation. It also does not require a confirmation token, idempotency key, or server-side proof of final user authorization. Consequently, an implementation that follows the instructions literally may violate the expected authorization boundary for purchase operations. ### Attack Path 1. A cart and checkout context are supplied to the Agent. 2. The Agent validates the cart and collects shipping and payment selections. 3. Following Step 4, the Agent calls `http://localhost:5678/webhook/checkout-process`. 4. The backend processes a payment, creates an order, or reserves inventory. 5. Only after that side effect does the Agent display the order summary and request final confirmation. 6. The user may reject the transaction, but the backend action may already have occurred. ### Impact Assessment The flaw does not grant operating-system privileges. Its scope is the checkout transaction and any backend operations available through the processing webhook. Depending on the undocumented webhook behavior, it could cause unauthorized payment ...[truncated 126 chars]
• Remediation: ## Remediation Suggestions 1. Move order review and explicit final confirmation before any state-changing checkout or payment request. 2. Separate preview and commit operations: - Use a non-mutating endpoint to calculate totals and display the final summary. - Invoke the payment or order-creation endpoint only after explicit confirmation. 3. Require a short-lived, server-generated confirmation token bound to the authenticated user, cart contents, amount, currency, shipping address, and selected payment method. 4. Reject processing requests if cart details differ from those the user confirmed. 5. Use idempotency keys to prevent duplicate payments or orders when requests are retried. 6. Clearly document whether each webhook is read-only or state-changing and require an additional confirmation if inventory or pricing changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17
• Finding: Sensitive Checkout Webhooks Lack Documented Transport and Request Authentication Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 17-26 **Vulnerability Type**: Insecure sensitive-operation endpoint configuration **Risk Level**: Medium **Vulnerable Code Snippet**: ```md ### Step 1: Validate Cart Call n8n webhook at http://localhost:5678/webhook/checkout-validate to check cart items availability and inventory status ### Step 2: Check Authentication Determine if user is authenticated from context. If guest, present login options or continue as guest. ### Step 3: Collect Shipping Information Show saved addresses for authenticated users or collect details for guests. ### Step 4: Payment Processing Present payment options and call n8n webhook at http://localhost:5678/webhook/checkout-process ``` ### Technical Analysis The skill directs checkout operations to plaintext HTTP endpoints and does not document webhook authentication, authorization binding, request signing, replay prevention, response authentication, or endpoint identity validation. Although the endpoints use `localhost`, loopback addressing alone is not an authentication control. Another local process could bind to the expected port, a compromised n8n instance could handle the requests, or container and proxy configuration could cause `localhost` traffic to reach an unintended component. The workflow also does not state that authenticated user identity, cart ownership, or authorization claims must be validated by the webhook itself. The instructions prohibit storing or logging full payment details, but they do not explicitly prohibit transmitting raw payment credentials to the webhook. Therefore, a literal implementation may expose sensitive checkout information to an unverified local service. ### Attack Path 1. An attacker gains control of the service listening on local port `5678`, compromises the configured n8n workflow, or exploits local proxy or container routing. 2. The Agent follows the skill and sends cart, shippi ...[truncated 867 chars]
• Remediation: ## Remediation Suggestions 1. Require authenticated webhook requests using a narrowly scoped service credential or mutually authenticated local transport. 2. Sign requests with a timestamp, nonce, and message authentication code; reject expired, modified, or replayed requests. 3. Bind every checkout request to the authenticated user, owned cart, intended operation, and server-side authorization state. 4. Use TLS when traffic can cross a host, container, namespace, proxy, or other trust boundary. For strictly local communication, prefer an authenticated Unix-domain socket or an equivalently protected transport. 5. Validate the identity and integrity of webhook responses before relying on them. 6. Add idempotency keys and server-side replay protection to all state-changing requests. 7. Explicitly prohibit sending raw card numbers, CVVs, or other full payment credentials. Use tokenized payment-method identifiers issued by a compliant payment provider. 8. Restrict the n8n listener to the minimum required interface and enforce least-privilege access to the checkout workflows.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection

Content

---
name: haresh-checkout-flow
description: "Process e-commerce checkout via n8n webhook integration"
user-invocable: true

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill description and workflow state that it calls backend webhooks for cart validation and payment processing, but it does not clearly disclose to users that checkout data, authentication state, shipping details, and payment-related information may be sent to external backend services. This lack of transparency undermines informed consent and increases the privacy and security risk of transmitting sensitive transactional data.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger conditions are broad enough to match many ordinary shopping-related requests, which can cause this skill to activate in situations where the user did not clearly intend to initiate a checkout workflow. In a checkout context, unintended activation is risky because it can begin collecting or transmitting sensitive cart, identity, shipping, or payment-related data to backend systems.

Static analysis

No suspicious patterns detected.