Buyma Order Automation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:01 AM UTC
• Version: 1.0.0

Overview

The skill is an order-automation workflow, but it asks for broad browser/session access and can send order files externally without enough safeguards.

Review before installing. Use a dedicated Chrome profile only for BUYMA/Naver Mail, require confirmation before editing memos or sending any email/Telegram attachment, verify recipients and file paths, sanitize spreadsheet cells against formulas, and define retention/cleanup for generated workbooks and state files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parse_buyma_csv.py:57

Finding

Untrusted CSV Values Can Be Written as Executable Spreadsheet Formulas

Content

View full analysis

Remediation

View remediation

str: text = "" if value is None else str(value) stripped = text.lstrip() if stripped.startswith(("=", "+", "-", "@")): return "'" + text return text cell = ws[f"{col}{row}"] cell.value = safe_spreadsheet_text(rec.get(key, "")) cell.data_type = "s" ``` 5. Do not apply textual escaping to legitimate numeric fields. Validate and convert those fields to `int`, `Decimal`, or another expected numeric type instead. 6. Extend `validate_output.py` to inspect `cell.data_type` and fail if any externally populated cell is a formula: ```python if cell.data_type == "f": formula_cells.append(cell.coordinate) ``` 7. Add tests using values with leading `=`, whitespace followed by `=`, and other common formula prefixes. 8. Do not send or publish the workbook if formula validation fails. ]]>

other

Warning

• Location: SKILL.md:31

Finding

Workflow Requests Unrestricted Access to General Agent Memory

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26

Finding

Use of the Default Chrome Profile Violates Least Privilege

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a broad operational automation workflow involving web access, CSV handling, workbook generation/enrichment, email delivery, and failure notifications. The supplied code does none of those things. It only performs a localized workbook-editing task: loading JSON, mapping order numbers to Korean product names, writing values into column F for a given row range, optionally coloring cells red when multiple names exist for the same order number, and saving the workbook. This is a materially different and much narrower behavior than the declared purpose, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-to-end BUYMA order-processing automation with web access, CSV acquisition/usage, workbook enrichment, email delivery, and Telegram failure alerts. The supplied code chunk only performs one narrow step: writing already-normalized records from a JSON file into an Excel workbook template. While this partially overlaps with the declared workbook-writing aspect, it does not implement most of the claimed workflow or external integrations. Because the actual behavior is materially narrower and uses different inputs/resources than described, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes a broad operational workflow for BUYMA order processing involving browser interaction, CSV/workbook handling, email delivery, and Telegram error notification. The supplied code does none of these things. It is a narrow utility that parses a local input text file in 2-line blocks, extracts a 6-digit order number with regex, and outputs JSON. This is a materially different primary purpose and lacks the major declared behaviors and integrations, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on an end-to-end operational workflow for Buyma order processing with browser interaction, CSV/workbook handling, email delivery, and Telegram failure alerts. The actual code does none of those things. It only parses command-line arguments, reads a local JSON file, performs simple hardcoded text replacements to translate product names from Japanese to Korean, filters rows missing order number or product name, and writes a new JSON file. This is a materially different primary purpose and lacks the key resources and behaviors described in the declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a broad order-processing automation workflow involving Buyma, Chrome access, CSV/workbook handling, email delivery, and Telegram alerts. The supplied code does none of those things. It only parses a plain text input file, looks for 6-digit numbers in alternating lines, and emits a translated_names-style JSON structure. This is a materially different primary purpose and lacks the declared external system interactions entirely.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This code chunk is a narrow utility for composing an output filename from a date and order range. That may support the larger workflow, but by itself it does not implement the declared skill description's substantive behavior. The declared description portrays a full automation pipeline with browser access, data processing, workbook generation/enrichment, email delivery, and failure notifications; none of those capabilities appear here. Therefore the supplied code chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description describes a broad end-to-end operational automation workflow involving browser access, BUYMA interaction, receipt memo handling, workbook generation/enrichment, email delivery, and Telegram error reporting. The supplied code chunk does only one narrow subtask: parse an input BUYMA CSV and emit normalized JSON. While CSV parsing is mentioned in the declaration as one component of the overall skill, this code does not implement most of the declared primary behavior or external integrations. Therefore the supplied chunk's actual behavior is materially narrower and different from the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a broad operational workflow for BUYMA order processing with browser automation, CSV/workbook handling, email delivery, and failure alerts. The actual code chunk does none of those things. It only validates the structure of a local text file and reports counts/warnings in JSON. This is a materially different primary purpose rather than a mere helper detail, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad end-to-end Buyma order-processing workflow involving web access, CSV handling, workbook generation/enrichment, email delivery, and Telegram failure notification. The actual code chunk does none of those tasks. It only validates whether certain cells in an existing Excel workbook are blank within a specified row range and prints the results as JSON. This is a materially different and much narrower purpose than the declared automation, so the description does not accurately represent the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill declares broad operational behavior involving local file reads and writes but does not define any explicit tool scope or permission boundaries. In an agent setting, missing scope increases the chance that the runtime grants overly broad filesystem access, enabling unintended access to adjacent files, prior workbooks, templates, and sensitive workspace data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill relies on persistent state across runs, including prior workbook history, latest delivered files, and Chrome default profile sessions. Persistent session and state reuse can expose prior user data, cross-contaminate runs, and unintentionally reuse authenticated browser sessions or sensitive artifacts beyond the minimum needed for the current task.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: buyma-order-automation
description: automate buyma order processing for regular daily runs and ad hoc order-range runs. use when chatgpt needs to access buyma in chrome, check or fill receipt memo numbers, download or use a provided buyma csv, write the tmazon order workbook, enrich rows from prior workbook history, and send the result by naver mail before a deadline or after an ad hoc request. stop immediately and notify by telegram with file attachment on buyma, csv, or mail failure.
---

# Overview

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs sending result files and failure attachments through Naver Mail and Telegram without explicit safeguards, approval checks, recipient validation, or warning about possible disclosure of order/customer data. This creates a real risk of exfiltrating sensitive business or personal information to third-party services or the wrong destination during both normal and failure handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file instructs operators to translate content to Korean and to use a Korean product name from Chrome auto-translation when filling fields. This is a natural-language locale requirement, but the document does not provide user opt-in, alternatives, or a documented justification that the workflow is explicitly region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The prescribed failure text format is fixed in Korean (BUYMA 자동화 실패 / 단계: {stage} / 파일 첨부) with no indication that the user can choose language or that the workflow is intentionally Korea-specific. This can violate language/locale policy when a skill mandates a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to 'Start at any practical time before deadline' does not define a concrete trigger or clear boundary for when this run mode should activate. In a markdown skill reference, this kind of broad activation language can lead to inconsistent or unintended invocation because almost any pre-deadline time could qualify as 'practical'.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to send Telegram notifications with a file attachment when failures occur, which creates an external data transmission path for potentially sensitive order or workbook data. Without explicit data-minimization rules, recipient validation, and user/operator warning, failure artifacts could leak customer, order, or business information to an external messaging platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The ad hoc mode says to 'send mail immediately' after building the workbook, which directs external transmission of order/workbook data without any visible confirmation, recipient verification, or warning about sensitivity. In a skill that processes order data and prior workbook history, this increases the chance of accidental disclosure, especially during ad hoc runs where operator input may be rushed or incomplete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly sends the generated workbook by Naver Mail, but it provides no user-facing confirmation, warning, or data-classification check before transmitting potentially sensitive order data to an external service. Because this skill handles order information and workbook history, silent outbound transmission increases the risk of unintended disclosure to the wrong recipient, unauthorized sharing, or sending data outside approved channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow instructs the agent to notify via Telegram with a file attachment on failure, but it does not warn the user that operational failures may trigger external sharing of order-related files. Error paths are especially risky because they can exfiltrate partial outputs, CSVs, or workbooks to a third-party messaging platform without review, which is dangerous in a skill that processes business order data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The function converts shipping method values into Korean-specific labels such as "사가" regardless of user preference or runtime locale selection. This is a natural-language locale policy concern because the script forces a specific language in generated output without offering opt-in or documenting that the tool is intentionally Korean-localized.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When the region is OKINAWA, the script appends the Korean string "오키나와" to the normalized note automatically. This forces a specific output language in generated data and does not provide a language choice or explain why Korean localization is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow requires filling fields using auto-translated Korean product names, which imposes a specific language/locale behavior. The document does not offer user opt-in or explain why Korean is required as a documented regional or compliance constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The rule explicitly requires preserving the generated workbook in orders/current/ after mail failure, but it does not mention retention limits, access controls, or notifying the user/operator that order data will remain on disk. In an automation handling order records, silent persistence can increase exposure of potentially sensitive business or customer data if the host is shared, compromised, or logs/artifacts are later collected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code performs a file write by saving the workbook to the provided output path, which can overwrite or create a spreadsheet file. While the script prints a summary after completion, there is no prior warning, confirmation prompt, or comment/docstring disclosing that it will modify filesystem contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs a file write containing parsed BUYMA order records, including fields such as contact notes, romanized names, and region data. While the CLI argument implies output generation, there is no visible disclosure in code comments, prompts, or logging that potentially sensitive order information will be persisted to disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.