Security audit

Alibaba Shopping Assistant

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a shopping assistant, but its instructions conflict about whether the agent may use logged-in shopping sessions and prepare orders.

Review this skill carefully before installing. It appears non-executable and not malware, but it may guide an agent into your logged-in shopping account, alter cart state, apply coupons, and expose address/order details despite claiming a no-login boundary. Use only if you are comfortable supervising every authenticated step, and do not let it proceed past public product comparison unless you explicitly intend that behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The skill declares a safe boundary of no order submission, no payment, and later P1 rules also forbid entering addresses, but other sections explicitly instruct the agent to add items to cart, apply coupons, select addresses, and generate an order preview. These contradictory instructions create unsafe ambiguity that can cause an agent to cross from informational assistance into transactional actions on a logged-in user account.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The supported-operations table authorizes state-changing actions such as Add to Cart, View Cart, Apply Coupons, and Generate Order, which directly conflict with the later safety boundary forbidding address entry and order submission. In practice, this can normalize partial checkout automation and lead the agent to manipulate a user's authenticated shopping session in ways the declared safety model does not permit.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The documented workflow explicitly includes login-required user pages and operations such as cart access, coupon application, address selection, and order generation, which exceed the stated safe boundary of 'no login, no order submission.' This creates a privilege and scope mismatch: an agent following the document could perform authenticated transactional steps on behalf of a user, increasing the risk of unauthorized purchases, exposure of personal data, or unintended progression toward checkout.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: Phase 3 directly instructs the agent to add items to cart, inspect cart contents, apply coupons, select a delivery address, and generate an order preview. Even if final payment is left to the user, these actions operate inside authenticated account context and materially advance a purchase, violating the declared boundary and risking unwanted account changes, privacy exposure, and accidental order initiation.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The overview asserts 'strict boundaries around user-controlled actions,' but the later workflow authorizes the agent to perform cart and pre-order operations. This inconsistency is dangerous because operators or downstream systems may trust the high-level safety claim while the detailed instructions quietly permit higher-risk behavior, leading to policy bypass by documentation ambiguity.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.