Haresh Product Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:24 AM UTC
• Version: 1.0.2

Overview

This product-search skill is not clearly malicious, but it needs Review because its code sends search queries to an undocumented external placeholder instead of the documented local n8n endpoint.

Review before installing. Only use this skill if you control the webhook destination and update the code or documentation so the endpoint is explicit and correct. Avoid entering sensitive product queries until the endpoint, payload minimization, response validation, timeout handling, and user disclosure are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:2

Finding

Undisclosed External Transmission of User Search Queries

Content

View full analysis

Vulnerability Details

File Location: index.js:2-6
Vulnerability Type: Hard-coded external endpoint and behavior-documentation mismatch
Risk Level: Medium

Vulnerable Code

js

const response = await fetch("https://your-n8n-webhook-url", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ query })
});

The runtime behavior conflicts with the endpoint documented at SKILL.md:20:

md

3. Use exec tool to POST to n8n webhook at http://localhost:5678/webhook/product-search

Technical Analysis

The implementation serializes the complete user-controlled query and transmits it to the hard-coded HTTPS host your-n8n-webhook-url. This differs from the documented behavior, which states that requests are sent to a service on localhost.

Consequently, users and operators may reasonably expect product-search information to remain within the local environment while the implementation attempts to send it to an external destination. If this hostname is replaced with or resolves to an attacker-controlled service during deployment, that service can collect every query submitted through the skill.

The endpoint is not loaded from a validated configuration source, constrained by an allowlist, or disclosed accurately in the skill documentation. The implementation also does not inspect or minimize potentially sensitive information contained in a query before transmission.

This finding does not establish remote code execution, credential theft, or deliberate malicious behavior. The exposed scope is limited to data supplied in the query parameter.

Attack Path

1. An operator deploys the skill while relying on the documentation indicating that requests use a localhost webhook.
2. The hard-coded hostname is made resolvable or replaced with an endpoint controlled by an untrusted party.
3. A user invokes search_products with a product query that in ...[truncated 1086 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the hard-coded placeholder with the intended local endpoint or an explicitly supplied deployment configuration:

   js

   const endpoint = process.env.PRODUCT_SEARCH_WEBHOOK_URL;
   if (!endpoint) {
     throw new Error("PRODUCT_SEARCH_WEBHOOK_URL is not configured");
   }
   

2. Validate the configured URL before use. Restrict its protocol, hostname, and port to an approved allowlist. If the service is intended to remain local, accept only loopback hosts such as 127.0.0.1 or localhost.
3. Keep the implementation and SKILL.md consistent. Clearly disclose when queries are transmitted to a third-party or remotely operated service.
4. Obtain appropriate user confirmation before sending queries externally, particularly when they may contain personal or confidential information.
5. Minimize transmitted data and reject or redact fields that are unnecessary for product search.
6. Define and validate the webhook response against a strict schema before returning it to the agent or presenting it to a user.
7. Apply request timeouts, response-size limits, and controlled error handling to reduce availability and resource-exhaustion risks.
8. Add automated tests that verify the destination against the documented endpoint policy and fail deployment when a placeholder hostname remains configured.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: haresh-product-search
description: "Search e-commerce products via n8n webhook integration"
user-invocable: true

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This code performs a direct POST request to an external URL and includes raw user input in the request body. While external calls can be legitimate, this is security-relevant because it creates an exfiltration path for potentially sensitive prompts or user-entered data, especially if the webhook is third-party managed or insufficiently governed.

Content

Scanner excerpt · index.js (reported line 2)May include surrounding context.

js

exports.search_products = async function ({ query }) {
  const response = await fetch("https://your-n8n-webhook-url", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ query })

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The function sends the user-provided query to an external webhook, which is an external data transmission point with no visible disclosure, consent, minimization, or restriction on what may be sent. In an agent skill context, users may provide sensitive data in queries, so forwarding it to a third-party endpoint can create privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.