Security audit

Ordercli

Security checks for vulnerabilities and agentic risk

Overview

The scanners classify this skill as benign with high confidence, while noting that it documents reorder actions beyond its stated order-checking purpose.

The scanner coverage was complete for the one reported Markdown component, though some behavior analyzers did not apply because there were no applicable files. Before installing, consider whether you are comfortable with the documented cart-changing reorder capability; the scanners did not independently verify its implementation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
ora reorder <orderCode>` - Confirm: `ordercli foodora reorder <orderCode> --confirm` - Address: `ordercli foodora reorder <orderCode> --confirm --address-id <id>` Cloudflare / bot protection - Browser login: `ordercli foodora login --email you@example.com --password-stdin --browser` - Reuse profile: `--browser-profile "$HOME/Library/Application Support/ordercli/browser-profile"` - Import Chrome cookies: `ordercli foodora cookies chrome --profile "Default"` Session import (no password) - `ordercli foodora session chrome --url https://www.foodora.at/ --profile "Default"` - `ordercli foodora session refresh --client-id android` Deliveroo (WIP, not working yet) - Requires `DELIVEROO_BEARER_TOKEN` (optional `DELIVEROO_COOKIE`). - `ordercli deliveroo config set --market uk` - `ordercli deliveroo history` Notes - Use `--config /tmp/ordercli.json` for testing.

The skill exposes cart-modifying reorder commands despite describing only order-history and status checking.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The manifest at L03 limits the stated purpose to checking past orders and active order status. L52-L56 document reorder commands that add items to a cart, including confirmed execution with an address ID. This changes remote shopping state rather than merely retrieving order information; the provided file documents this capability but contains no implementation to independently verify it.
Content: No source excerpt is available for this finding.