Roty Tiffin Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:56 AM UTC
• Version: 0.1.0

Overview

This live order-creation skill is under-scoped and ships undeclared browser automation with hardcoded credentials, so it should be reviewed carefully before installation.

Do not install this as-is for production use. Remove the Playwright scripts and hardcoded credentials, rotate the exposed account password, align the documentation with actual live/dry-run behavior, require an explicit final confirmation with order totals and delivery dates, cap order size, and ensure authorization cannot be bypassed by caller-controlled source or environment values.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/roty_order_automation.py:193

Finding

Hardcoded Bitely Account Credentials in Executable Browser Automation

Content

View full analysis

0 and await page.locator(pass_sel).count() > 0: await page.fill(email_sel, '[e-mail]') await page.fill(pass_sel, 'Samwisethebot') log(f'Filled login email and password via selectors {email_sel} and {pass_sel}') # attempt to click login login_btn = "button:has-text('Login')" if await page.locator(login_btn).count() > 0: await page.locator(login_btn).first.click() ``` ### Technical Analysis The package contains an email address and password directly in distributed source code. Anyone who can download the Skill, inspect the installed files, access a package cache, or read a source archive can recover these values without executing the application. Both browser automation scripts actively enter the credentials into the Bitely login page. The second script also clicks the login button when it is found. This is inconsistent with the security guidance in `README.md`, which states that secrets and API keys should be supplied through environment variables rather than included in the package. Source-code access must be treated as sufficient to disclose hardcoded credentials. Obfuscating the string ...[truncated 1276 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/handle_message.py:89

Finding

Confirmed Live Orders Are Submitted Without Final Approval or Cost Limits

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/roty_order_automation.py:49

Finding

Bundled Browser Automation Exceeds the Declared POST-Only Capability

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: INSTALL_README.txt:12

Finding

Installation Instructions Execute an Unpinned npm Package Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring claims the script stops before final confirmation, but the implementation performs real browser actions that alter application state: it clicks product options, adds items to cart, proceeds to checkout, and submits login and checkout data. This mismatch is dangerous because operators or downstream systems may trust the script as non-impacting when it can authenticate to a live service and prepare an order with real user data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script contains hardcoded email and password values directly in source code, which creates an immediate secret exposure risk through source control, logs, artifact distribution, or reuse by unauthorized parties. In this skill context, the credentials are especially dangerous because they are automatically entered into a live ordering workflow, enabling account access and potentially fraudulent purchases.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The final log message states the run is a 'safe dry-run' and that no order is placed, but by that point the script has already made live changes including cart updates, checkout navigation, and credential entry. Misleading safety messaging increases the chance that a human or orchestrator runs the script in production under false assumptions, causing unauthorized transactions or account activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script contains hardcoded credentials and automatically fills checkout PII on a live commerce site, enabling authenticated actions without user approval. Even if it stops before final confirmation, logging in and transmitting personal data to a third-party service is sensitive behavior that can expose accounts, normalize unsafe automation, and be repurposed to complete purchases with minimal changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script detects a login form and injects hardcoded email and password values, then attempts to submit them automatically. This is dangerous because it embeds account secrets in code, performs credential use without user confirmation, and creates a straightforward path to unauthorized or accidental authenticated actions on a third-party account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub install without pinning an exact package version allows retrieval of whatever version is current at execution time. In a host/container registration workflow, this creates a supply-chain risk where a compromised, typosquatted, or newly published version could execute arbitrary code during install with the container's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The repeated recommendation to run unpinned npx clawhub means the installation behavior depends on the latest published package at runtime rather than a reviewed artifact. Because this README instructs an operator to execute the command inside a live container, exploitation could lead to arbitrary code execution, persistence, or modification of skill routing and handlers.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file claims the skill is safe because it runs in dry-run mode by default, but immediately provides explicit instructions and ready-to-use examples for sending a live POST to a production endpoint. This creates a misleading safety boundary: an operator may believe the skill is non-impacting while still being guided to transmit real order and customer data with a simple trigger phrase or copied command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown includes examples that send customer-related fields such as address, name, email, and phone metadata to an external service without any explicit privacy warning, consent requirement, or data-handling notice. In a skill that processes order details, this increases the likelihood of unreviewed disclosure of personal data to a live third-party endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill contains direct instructions for constructing curl commands that POST structured order data to an external cloud endpoint, including potentially sensitive fields such as user references and addresses. Even if intended for legitimate automation, embedding turnkey exfiltration/transmission guidance in the skill materially enables external data transfer and makes accidental or unauthorized disclosure easier.

Content

Scanner excerpt · RULES.md (reported line 24)May include surrounding context.

md

5) Safety
- The skill will run in dry-run mode by default (logs the exact POST body) and only send to the live endpoint when you explicitly say "POST now".

6) Curl generation (automation-safe)
- When generating curl commands, always produce either a valid single-line command or a multiline command that uses proper shell line-continuation (backslashes) or a here-document. Never leave an open single-quoted JSON string across literal newlines.
- Preferred single-line (automation-safe): compress the JSON payload into a single line and wrap the URL and headers in double quotes. Example:
  curl -sS -X POST "https://newdailyorderandcartcreation-818352713629.australia-southeast1.run.app" -H "Content-Type: application/json" -d '{"userRef":"CR6osYANseVNs089MuMqwPNdKXF3","vendorRef":"qfiDIvUSocQFrVPzM4zQ","status":"Confirmed","pickup":false,"userAddress":"46 Kwinana Street, Glen Waverley VIC 3150","deliveryInstructions":"","preferredTime":"","deliveryCost":0,"discount":"totalorder:0","bankTransfer":true,"bankTransferReference":"","cash":false,"customerName":"Kwinana Street","customerEmail":"","customerPhoneNumber":"","selfManagedNdisTransaction":false,"listOfOrderDetails":[{"name":"Veg Tiffin","productRef":"F7T1VBKNLNmwRrU9l8pb","quantity":1,"modifier1Name":"Selection","modification1":"6 rotis","modifier2Name":"Customisations (free unless priced)","modification2":"Normal","specialRequests":"","image":"","isCatering":false,"deliverySchedule":"03/03/2026","perProductCost":"[15]"}]}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to send a live HTTPS POST immediately after parsing, without requiring an explicit user confirmation step or presenting a clear warning that the action creates a real external order. This creates a meaningful risk of unintended purchases or fraudulent order submission if a message is misparsed, spoofed, or triggered accidentally, especially because the skill is activated by message content and performs an irreversible side effect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The alias list for the product includes the very short trigger "nv", which is overly broad and can overlap with common shorthand or incidental user text. In a conversational ordering flow, this can cause unintended product matches or prompt-routing mistakes, potentially leading to incorrect orders or abuse of the skill's invocation logic.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code explicitly skips the allowed-user check whenever openclaw_context is true, which can be triggered either by source == "openclaw" or by the OPENCLAW_CONTEXT=1 environment variable. That means any caller able to influence the source value or runtime environment can place orders without being present in allowed_users.json, creating a direct authorization bypass for a state-changing operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

By allowing OpenClaw context to bypass normal authorization without any explicit warning or compensating control, the code makes a privileged path less visible and easier to misuse. In a chat/ordering skill, hidden privileged behavior is especially dangerous because it can lead to unauthorized real-world purchases or deliveries through a simple message flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The function sends an order payload to an external handler via post_order(payload), which is a safety-relevant network operation affecting user data and creating a live order. In this file, there is no confirmation prompt before the live POST and no comment/docstring warning that a real external order submission occurs when DRY_RUN is not enabled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module defines find_product_by_intent_or_alias at L024, but both __main__ blocks invoke find_product_by_intent, which is not defined anywhere in this file. This contradicts the apparent intent of the script-level usage example/documented invocation path, because the entrypoint claims to exercise product matching but would instead fail at runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The admin check can be bypassed by passing the caller-controlled openclaw_context flag as true, which effectively disables authorization for product onboarding. In a skill that writes to a shared product catalog, this allows unauthorized users or code paths to modify persistent product data, undermining integrity and potentially affecting downstream ordering logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code performs a persistent file write to the product catalog via json.dump(..., open(PRODUCT_FILE,'w')). While the function name suggests onboarding, there is no confirmation prompt and no comment/docstring or visible user-facing warning near the write indicating that existing product data will be modified on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script forces date parsing to use the Australia/Melbourne timezone via a fixed ZoneInfo value. This is a natural-language policy concern because it imposes a locale-specific behavior without any visible opt-in, override, or justification in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script parses and extracts personally identifiable information including phone numbers, email addresses, names, and street addresses, then prints the full parsed structure when run as a CLI. This can expose sensitive customer data in terminal history, process logs, shell auditing, or downstream log aggregation systems without any minimization or explicit consent handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code serializes the provided payload and sends it to a remote HTTPS endpoint, but there is no confirmation prompt, logging, comment, or docstring explaining that user or system data may be transmitted off-host. Because the function accepts arbitrary payload content, callers may send sensitive data without any visible warning in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The automation enters sensitive data including login details, name, phone number, and address into a live checkout flow without meaningful consent, masking, or privacy controls. In a browser automation skill, this is more dangerous because screenshots are also captured repeatedly, increasing the chance that personal data appears in stored image artifacts or operator-visible logs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script presents itself as a safe dry-run while still driving a real browser against a production ordering site, navigating through cart, checkout, and optional login flows. That mismatch is dangerous because operators may trust the label and run code that performs real authenticated interactions and transmits data to a live service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically fills name, phone number, and address fields during checkout and earlier attempts to populate address inputs, causing personal information to be transmitted to a live third-party service. This is risky because users are not warned, the data may be stored or processed externally, and the behavior can trigger unintended real-world fulfillment steps.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring states the tool only simulates mouse clicks and stops before submission, but the implementation also prints and simulates entry of personal and authentication-related data such as name, phone, address, and login actions. This mismatch can mislead operators into treating the script as lower risk than it is, increasing the chance that sensitive data is exposed in logs, terminals, chat transcripts, or screenshots during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.