T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:36- Finding
Administrative Store Credentials Are Collected Through Chat and Persisted in General Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
SEO Product Auditor
Security checks for vulnerabilities and agentic risk
Overview
The skill’s SEO audit purpose is clear, but it asks users to share live store credentials in chat, stores them in memory, and can make bulk product changes, so it needs careful review before install.
Install only if you are comfortable giving the agent store API access that can read and update product listings. Prefer read-only credentials for audits, avoid pasting live admin secrets into chat where possible, verify the Shopify scopes before use, and require explicit review of product IDs and changed fields before any bulk update.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:133- Finding
WooCommerce Basic Authentication Credentials Can Be Sent to an Unvalidated Configurable Domain
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
README.md:52- Finding
README Requests Unnecessary Shopify Content Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct secret-disclosure pattern: the skill explicitly asks the user to paste a live Shopify token into the conversation. In the context of a bot skill that can modify products and metafields, compromise of that token could allow unauthorized SEO changes, content tampering, and broader store administration depending on granted scopes.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Requesting WooCommerce consumer key and secret in chat creates the same high-risk secret exposure channel. The skill context makes this more dangerous because the credentials are intended for a system that audits and updates product data, so leaked API keys could be abused for unauthorized store changes or data extraction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The setup instructs users to paste a live Shopify access token directly into the bot conversation, but provides no warning about credential sensitivity, storage, logging, or safer alternatives. This is dangerous because chat systems, agent frameworks, and observability pipelines often retain prompts and tool context, so exposing admin-scoped tokens in chat can lead to credential theft and full store modification access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The WooCommerce setup similarly requests a consumer key and consumer secret in the conversation without any credential-handling warning or secure entry channel. Because these credentials can grant API access to product and store data, disclosure through chat transcripts or backend logs could enable unauthorized reads and writes.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The scoring table includes 'UK English' as a built-in criterion and says it will be fixed on rewrite, which implies a locale preference is imposed by default. The document does not offer a language/locale choice or justify that the skill is intended only for a UK-specific context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example uses short natural-language replies such as "fix top 10", "fix [name]", "full list", and "export" as action triggers without showing stronger confirmation or binding them to a clearly scoped prior context. In a conversational agent, broad triggers can be matched accidentally or after context drift, leading to unintended product updates, data disclosure, or exports.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The audit criteria explicitly score products against "UK English," and later examples continue checking for US spellings as a quality condition. This is a natural-language locale policy constraint presented as default behavior, but the file does not offer the user a language/locale choice or explain a region-specific requirement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase "fix it" is highly ambiguous because "it" depends entirely on conversational context and may resolve incorrectly if the session contains multiple products or prior operations. That ambiguity is risky here because the documented behavior is to apply content changes and later push them to the store.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example presents bulk-update activation with short responses like "YES / review each one first / skip" for changes affecting 10 products. Because this is a mass-write operation, vague confirmation language increases the chance of accidental approval, prompt confusion, or misuse after partial context injection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
"Fix these" is a vague command for generating and pushing meta descriptions to 61 products, which creates a large blast radius from a minimal utterance. In this skill context, the danger is amplified because the action modifies many live store listings and could be triggered from a loosely defined prior result set.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that the auto-fix rewrites product content 'in UK English' as part of normal operation. This is a natural-language locale constraint presented as mandatory behavior, with no indication that users can choose another locale or opt in explicitly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This line imposes a specific language variant ('UK English') for all generated content. Under the policy, forcing a locale without user choice or a clearly justified region-specific scope is a reportable natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The overview states that rewrites occur 'in UK English,' and later sections enforce UK English terminology and formatting as a universal requirement. This is a natural-language locale policy constraint applied by default, with no user opt-in or offered language/locale choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough to match common requests like 'check my listings' or 'what's wrong with my listings', which can cause the skill to activate in contexts the user did not clearly intend. Because this skill can later fetch store data, store credentials in memory, and prepare write operations, ambiguous activation increases the risk of unintended access to sensitive commerce workflows.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file shows the skill exporting audit data and saving a CSV to a local workspace path, which affects user data handling and creates a file on disk. The example announces success after the fact but does not warn beforehand that product data and admin URLs will be written to local storage.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill instructs the agent to save a CSV audit file into the workspace without warning the user that product titles, scores, admin URLs, and related business data will be written to local storage. This can create unintended data persistence and exposure, particularly in shared or retained workspaces.
- Content
Static analysis
No suspicious patterns detected.