Security audit

Waimai Merchant

Security checks across malware telemetry and agentic risk

Overview

This is a local SQLite-based merchant management CLI with disclosed create/update/delete operations and no evidence of exfiltration or hidden behavior.

Install only if you want a local merchant/product management database on this machine. Treat delete, reject, suspend, product deactivation, sold-out, price, and delivery-time changes as real local data changes; ask the agent to show the target record and confirm before running them, and back up ~/.waimai-merchant/merchant.db if the data matters.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill exposes administrative lifecycle operations such as approve, reject, suspend, update, list, search, and delete that go beyond the declared purpose of merchant registration and basic merchant management triggers. In an agent/tooling context, this scope expansion increases the chance that a user or prompt can invoke powerful actions that were not expected, reviewed, or authorized, leading to unauthorized business-state changes and privacy exposure.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The delete command permanently removes merchant records, which is a destructive administrative capability not justified by the stated skill purpose and highly risky in an agent-exposed interface. If invoked accidentally, by prompt manipulation, or by an unauthorized caller, it can cause irreversible data loss and business disruption.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill manifest describes merchant registration, product management, price updates, and delivery time settings, but this file exposes moderation-style lifecycle controls such as approve, reject, and suspend. That scope mismatch is dangerous because an agent or integrator may grant or invoke capabilities that were not disclosed to users or reviewers, enabling unauthorized merchant account governance actions.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The exported deleteMerchant function provides destructive data-management capability that is not reflected in the skill’s stated functionality. Hidden destructive operations increase the risk of abuse, accidental invocation, or under-reviewed privilege expansion, especially in agent ecosystems where manifests are relied upon for trust and scope decisions.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file implements merchant approval, rejection, suspension, and deletion functions that materially exceed the manifest’s stated scope of registration, product management, price updates, and delivery-time settings. Hidden administrative lifecycle controls increase the attack surface and could enable unauthorized account status changes or destructive actions if these functions are exposed through the skill or callable by an agent without strict authorization.

Description-Behavior Mismatch

Low

Confidence: 85% confidence
Finding: The code exposes bulk enumeration and search capabilities over merchant records that are not described in the manifest. While not inherently malicious, undeclared listing/search functions can facilitate unnecessary data access, merchant discovery, and privacy exposure, especially if the skill is expected to handle only targeted merchant registration or updates.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The delete operation executes immediately with no confirmation prompt, no dry-run, and no safety interlock. In agent environments, where actions may be triggered from natural-language requests or ambiguous prompts, the absence of confirmation materially increases the likelihood of accidental or socially engineered destructive actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The delete command removes a product immediately after a simple existence check, with no confirmation prompt, dry-run mode, soft delete, or undo protection. In a merchant-management skill, accidental or automated invocation could cause loss of product data or disrupt storefront availability, especially if the agent issues commands on behalf of a user.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The delete command permanently removes merchant records immediately after resolving the ID, with no confirmation prompt, dry-run, or undo/soft-delete safeguard. In a CLI handling business entities, this makes accidental or scripted misuse much more likely and can cause irreversible data loss or operational disruption.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The delete command performs an irreversible destructive action immediately after resolving the product ID, with no confirmation prompt, dry-run, or force flag semantics. In a merchant-management CLI, this increases the chance of accidental or scripted data loss from mistyped IDs or unsafe automation.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "author": "OpenClaw", "license": "MIT", "dependencies": { "commander": "^11.0.0", "better-sqlite3": "^9.0.0", "chalk": "^4.1.2", "inquirer": "^8.2.6"
Confidence: 84% confidence
Finding: "commander": "^11.0.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "license": "MIT", "dependencies": { "commander": "^11.0.0", "better-sqlite3": "^9.0.0", "chalk": "^4.1.2", "inquirer": "^8.2.6" },
Confidence: 87% confidence
Finding: "better-sqlite3": "^9.0.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "dependencies": { "commander": "^11.0.0", "better-sqlite3": "^9.0.0", "chalk": "^4.1.2", "inquirer": "^8.2.6" }, "devDependencies": {
Confidence: 80% confidence
Finding: "chalk": "^4.1.2"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "commander": "^11.0.0", "better-sqlite3": "^9.0.0", "chalk": "^4.1.2", "inquirer": "^8.2.6" }, "devDependencies": { "@types/node": "^20.0.0",
Confidence: 83% confidence
Finding: "inquirer": "^8.2.6"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "inquirer": "^8.2.6" }, "devDependencies": { "@types/node": "^20.0.0", "@types/better-sqlite3": "^7.6.0", "@types/inquirer": "^8.2.10", "typescript": "^5.0.0",
Confidence: 72% confidence
Finding: "@types/node": "^20.0.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: }, "devDependencies": { "@types/node": "^20.0.0", "@types/better-sqlite3": "^7.6.0", "@types/inquirer": "^8.2.10", "typescript": "^5.0.0", "ts-node": "^10.9.0"
Confidence: 72% confidence
Finding: "@types/better-sqlite3": "^7.6.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "devDependencies": { "@types/node": "^20.0.0", "@types/better-sqlite3": "^7.6.0", "@types/inquirer": "^8.2.10", "typescript": "^5.0.0", "ts-node": "^10.9.0" }
Confidence: 72% confidence
Finding: "@types/inquirer": "^8.2.10"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "@types/node": "^20.0.0", "@types/better-sqlite3": "^7.6.0", "@types/inquirer": "^8.2.10", "typescript": "^5.0.0", "ts-node": "^10.9.0" } }
Confidence: 76% confidence
Finding: "typescript": "^5.0.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "@types/better-sqlite3": "^7.6.0", "@types/inquirer": "^8.2.10", "typescript": "^5.0.0", "ts-node": "^10.9.0" } }
Confidence: 78% confidence
Finding: "ts-node": "^10.9.0"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.