Security audit

Shopify JSON-LD Parser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local Shopify JSON-LD parsing helper with some broken or overstated functionality, but no evidence of hidden, destructive, persistent, or exfiltrating behavior.

Install only if you are comfortable with a skill that asks the agent to fetch/read Shopify HTML, write a temporary local file, and run a local Python parser. Treat it as nonfunctional until the Python syntax and overstated CLI options are corrected; avoid piping untrusted text into the no-argument mode.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The core purpose mostly aligns: the script does parse JSON-LD from HTML, find Product objects recursively (including within arrays/@graph-like structures), extract offer details, and infer inventory/availability. However, there are material description-behavior mismatches in advertised functionality. The CLI advertises --output json|yaml but always emits JSON, so YAML support is undeclared in behavior. The description suggests use on local files or web page content broadly, but the code only properly handles file paths; its stdin branch incorrectly passes raw bytes into Path(), which will fail rather than parse piped HTML. It also advertises querying structured data such as prices across variants or offer counts, but the implemented query is only a minimal dot-and-index traversal over the final result object, not a substantive JSON-LD query capability. These are meaningful overstatements even though the primary parsing behavior is consistent with the description.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation states the script supports --query, --field, and --output json|yaml flags and that it validates schema.org types, but the rest of the file only describes a basic parser invocation with JSON output and no evidence of those additional capabilities. This creates an intent-code divergence because the documentation actively claims behavior beyond the actual parser purpose described elsewhere.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented interface says the tool can parse HTML input directly, but the implementation actually expects a file path and misroutes stdin content into filesystem access. This mismatch is security-relevant because callers may safely pass untrusted HTML expecting content-only parsing, while the tool instead may touch local files, creating confused-deputy behavior in automation or agent workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The no-argument code path is broken: it reads raw stdin bytes and passes them to Path(...), causing stdin content to be interpreted as a filesystem path rather than HTML content. In an agent context, untrusted upstream input could therefore trigger unintended local file reads if the stdin bytes happen to name a readable path, violating expected input boundaries and potentially exposing local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code opens and reads the entire file specified by the user via input_path.read_text(), but there is no user-facing print/log message at execution time describing that local file contents will be accessed. For code-file SQP-2 checks, file reads affecting user data can merit a warning when the behavior is not otherwise disclosed in visible runtime messaging or comments near the operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.