Security audit

ordercli

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill benign with high confidence: scans found no executable scripts, while noting a possible credential-theft signature in a documented cookie command and reorder instructions beyond the stated checking purpose.

The verdict is benign, but benign does not mean risk-free. Before installing, consider whether you want a skill that includes cart-changing reorder instructions alongside order checks; the scan also raised an uncertain alert about its documented cookie command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
ora reorder <orderCode>` - Confirm: `ordercli foodora reorder <orderCode> --confirm` - Address: `ordercli foodora reorder <orderCode> --confirm --address-id <id>` Cloudflare / bot protection - Browser login: `ordercli foodora login --email you@example.com --password-stdin --browser` - Reuse profile: `--browser-profile "$HOME/Library/Application Support/ordercli/browser-profile"` - Import Chrome cookies: `ordercli foodora cookies chrome --profile "Default"` Session import (no password) - `ordercli foodora session chrome --url https://www.foodora.at/ --profile "Default"` - `ordercli foodora session refresh --client-id android` Deliveroo (WIP, not working yet) - Requires `DELIVEROO_BEARER_TOKEN` (optional `DELIVEROO_COOKIE`). - `ordercli deliveroo config set --market uk` - `ordercli deliveroo history` Notes - Use `--config /tmp/ordercli.json` for testing.

The skill exposes cart-modifying reorder commands despite describing only order-history and status checks.

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The manifest at L03 limits the stated purpose to checking past orders and active order status. L52–L56 instead instruct the agent to reorder with --confirm, explicitly described as adding items to a cart; modifying a shopping cart is outside that observational scope, even though it does not necessarily place an order.
Content: No source excerpt is available for this finding.