T09 · Insecure Skill Coding Practices
Error
- Location
CONFIG.md:27- Finding
Privileged Commerce API Credentials Collected Through Chat and Persisted in Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Order & Returns Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill is for legitimate store operations, but it asks users to put powerful Shopify and WooCommerce credentials into chat and agent memory.
Review before installing. Use only for a UK store, avoid pasting live API credentials into chat unless the OpenClaw environment provides a proper encrypted secret vault with redaction, and prefer least-privilege/rotatable credentials. Keep approval required for every refund, cancellation, address change, fulfillment update, fraud hold, and customer email.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The setup guide instructs users to paste a live Shopify access token directly into bot chat, with no warning about secret handling, storage, logging, or least-privilege controls. Because the requested token is paired with broad write scopes over orders, fulfillments, inventory, and draft orders, compromise of the bot, chat history, or logs could enable unauthorized business actions and data access.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct secret-handling flaw: the guide tells users to paste live Shopify credentials into bot chat for storage/configuration. Chat interfaces commonly retain transcripts and may forward content to logs, analytics, support tooling, or model context, turning the token into a reusable secret that can be exfiltrated and used to manipulate store operations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The WooCommerce instructions ask the user to send a consumer key and consumer secret in a bot message, again without any secure-channel guidance or disclosure of how secrets are stored. Read/write WooCommerce API keys can expose order and customer data and allow unauthorized order or inventory changes if the conversation, backend logs, or the agent itself is compromised.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill asks for WooCommerce API credentials through a conversational message, which is an unsafe channel for high-value secrets. Since the keys have read/write permissions, exposure would let an attacker access customer/order data and perform sensitive store modifications, and the danger is amplified by the skill's operational purpose of managing orders and returns.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Refund: £38.98 → Stripe (James Thornton) Restock: +1 Merino Wool Scarf Navy ✅ Email: Return instructions sent ✅
text ---
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Refund: £38.98 → Stripe (James Thornton) Restock: +1 Merino Wool Scarf Navy ✅ Email: Return instructions sent ✅
text ---
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md ## What it does - **Order lookup** — find any order by number, email, or customer name. Includes live carrier tracking for Royal Mail, DPD, Evri, DHL, and Parcelforce - **Returns & refunds** — full approval workflow, auto-restock, return instruction emails to customers, partial refunds - **UK law guard** — blocks illegal return denials and warns you before you expose the store to chargebacks or Trading Standards complaints - **Fulfilment** — mark orders as dispatched, add tracking numbers, notify customers - **Cancellations** — cancel unfulfilled orders with automatic refund and restock
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
PREFERRED_CARRIER # Default carrier for fulfilment notes
text Never log or repeat access tokens back to the user. ### Fetch location ID automatically (Shopify) On first inventory operation:
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md Important: set `restock_type: "no_restock"` in the refund body — restocking was already handled in the returns API call above. Double-restocking will inflate inventory. **Step 3 of 3 — Send return instructions to customer:** (Only if NOTIFY_CUSTOMER_ON_RETURN = true) Compose and send via Shopify email or the configured email tool:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The claim that the skill 'enforces these automatically' suggests it may autonomously apply refunds, cancellations, or return decisions based on generalized legal rules, without emphasizing review, jurisdictional nuance, or merchant confirmation. In this context, the skill already has broad write access to commerce systems, so misleading or overbroad automation could trigger unauthorized or erroneous financial and operational actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples include realistic-looking customer names, email addresses, phone numbers, postal addresses, tracking numbers, and order history directly in documentation. Even if illustrative, exposing detailed PII in a skill file normalizes unsafe handling of sensitive data and can leak personal or production-like information into model context, logs, screenshots, or downstream tooling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file demonstrates operational workflows that can trigger refunds, cancellations, fulfilment, fraud holds, address edits, and customer notifications, but it lacks a clear top-level warning that these are high-impact actions affecting orders and payments. In an agent skill context, this can encourage unsafe execution without explicit confirmation, authorization checks, or operator awareness of financial and customer-service consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to provide a Shopify access token directly in a chat command (
Set my store: ..., token: shpat_xxx) without warning that this is a sensitive secret. In a messaging-based skill, this creates a real risk of credential exposure through chat logs, screenshots, integrations, or model memory, which could enable unauthorized store access and order/inventory manipulation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill can cancel orders, issue refunds, restock inventory, modify shipping addresses, place fraud holds, and send customer-facing emails, but its overview does not prominently warn that it performs destructive and externally visible actions. In a chat-driven workflow, that omission increases the risk of accidental invocation or operator misunderstanding, which can lead to unauthorized business actions and customer communications.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill hardcodes UK consumer-law handling and says compliance is enforced throughout, but it does not gate activation to UK stores or require explicit user confirmation that the business operates under UK rules. If used on non-UK stores, it could drive legally incorrect refund/return decisions and misleading customer communications.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill explicitly permits auto-approving returns and refunds when a config flag is disabled and the amount is below a threshold. This is autonomous execution of financial and inventory-affecting actions from conversational input, increasing the risk of mistaken, spoofed, or manipulated refunds without a fresh human approval checkpoint.
- Content
YES · DENY · PARTIAL [amount]
text Auto-approve (skip this step) only if REFUND_APPROVAL_REQUIRED = false AND refund amount ≤ HIGH_VALUE_APPROVAL_FLOOR. ### Step 5a — Approve: create return and refund
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 82% confidence
- Finding
The memory instructions direct the skill to learn approval and denial words and persist operational preferences after each interaction, which can expand what the system interprets as authorization without an explicit re-consent step. In a messaging environment, this raises the chance of ambiguous shorthand later triggering sensitive actions like refunds or cancellations.
- Content
md - `preferred_approval_words`: the words this owner uses to approve (e.g. "yes", "go", "do it", "approved") — learn from pattern so the skill recognises their shorthand - `preferred_denial_words`: same for denials - `RETURN_ADDRESS`: store once, use in every return email without asking again - `SHOPIFY_LOCATION_ID`: store once, avoid re-fetching every session - `PREFERRED_CARRIER`: the carrier this merchant most often uses — pre-fill in fulfilment prompts - `FRAUD_THRESHOLD_ADJUSTED`: if owner ever says "change my fraud threshold to £X", update and store
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
Lines L61-L62 state that dates are always in UK format and currency is always GBP, which imposes a fixed locale/output convention. Although the README says the skill is UK-focused, it does not clearly frame these formatting constraints as optional or explicitly justify them as a region-specific limitation for all users.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
Line item edits (add/remove products)
Shopify's line item editing requires the GraphQL Admin API (
orderEditBegin,orderEditAddLineItem,orderEditRemoveLineItem,orderEditCommitmutations). This is beyond the scope of this skill's REST-based implementation.When the user asks to add or remove items from an existing order, respond:
text
Static analysis
No suspicious patterns detected.