morrisons

• Outcome: Review
• Latest audit: Sep 2, 2026 · 7:55 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent grocery automation, but it needs review because it can change your Morrisons account, use session cookies, send WhatsApp alerts, and run a delayed background check.

Install only if you are comfortable giving the skill access to your Morrisons account, order history, trolley, delivery-slot reservations, and shopping lists. Configure an explicit Morrisons-specific WhatsApp target before using slot reminders, avoid importing cookies from any untrusted source, and use extra care with delete-list, list-to-cart, add, and book-slot because they change account state immediately.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents use of environment variables and networked automation but does not declare corresponding permissions. This creates a transparency and consent problem: users may grant trust to a skill without realizing it can access local credentials and communicate with external services. In this context, the capability is aligned with grocery automation, but undeclared env access is more sensitive because it may expose stored account credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes beyond routine shopping automation by including credential-based login, cookie import, WhatsApp notifications, and a detached delayed follow-up process. These additional capabilities expand the trust boundary from simple shopping actions to account access, local secret handling, third-party messaging, and persistent background execution, all of which materially increase privacy and security risk if abused or misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill includes WhatsApp notification behavior and reminder workflows that are not part of the stated grocery-management scope. Hidden or undeclared outbound messaging increases the attack surface because the skill can contact external recipients and disclose activity such as reservations or account state without the user's explicit expectation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads generic WhatsApp/OpenClaw configuration from outside the skill and falls back to the first allowed WhatsApp contact, which can route messages to an unrelated person or group. In a skill that automates a grocery account, this creates unnecessary cross-skill data access and can leak shopping, order, or checkout status to unintended recipients.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill spawns external processes to send WhatsApp messages and later launches a detached follow-up job with the full inherited environment. External process execution broadens the trust boundary, and passing all environment variables can expose credentials or tokens to subprocesses and make behavior harder to audit or contain.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The skill can import arbitrary cookie files or raw Cookie headers and convert them directly into authenticated browser state, which is a powerful account-takeover capability not reflected in the skill description. In this context, accepting externally supplied session material enables impersonation of another account and bypasses normal login flows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill describes actions that can modify or delete shopping lists and transfer items into the active trolley without clear warnings that account data will be changed. In an automation context, insufficient warning increases the risk of unintended purchases, list loss, or account state changes triggered by ambiguous prompts or user misunderstanding.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The skill advertises access to previous orders, itemized receipts, and order history without a clear privacy warning. While this may be part of the intended functionality, order history contains sensitive personal and household consumption data, so lack of disclosure can lead to overexposure or inappropriate sharing in agent outputs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Deleting a shopping list is a destructive account action, and the code performs it immediately once invoked without any confirmation step. In an automation setting, this raises the risk of accidental or prompt-induced destructive changes to user data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Booking a delivery slot reserves an account resource and can trigger time-sensitive checkout pressure, yet the function proceeds without an explicit pre-action confirmation. This makes prompt-injection or simple misunderstanding more likely to cause unintended account-affecting reservations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The cookie/session import path overwrites the existing authentication state file directly and without warning. That can silently replace the user's active session, cause account confusion, or install an attacker-supplied authenticated context for later privileged actions.

Credential Access

High

• Category: Privilege Escalation

Content

], {
      detached: true,
      stdio: 'ignore',
      env: { ...process.env }
    });
    child.unref();
    console.log('Follow-up check scheduled successfully.');

• Confidence: 90% confidence
• Finding: The detached follow-up job inherits the entire process environment via `env: { ...process.env }`, which can expose Morrisons credentials and any unrelated secrets to a subprocess. Expanding the trust boundary to background child processes increases the chance of credential leakage, misuse, or accidental logging by downstream tooling.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: morrisons-action.ts:16

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: morrisons-action.ts:2038