E Store Skill

• Outcome: Review
• Latest audit: Jun 22, 2026 at 2:35 AM UTC
• Version:
  0.1.0

Overview

This marketplace skill is not clearly malicious, but it gives agents broad authority to search, download, and install third-party capabilities without strong user-confirmation boundaries.

Install only if you are comfortable letting the agent contact e-store and help install third-party capabilities. Require explicit confirmation before any download, config write, skill/MCP install, or host reload, and treat the E_STORE_AK as a secret because the documented API puts it in request URLs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill’s top-level description instructs the agent to invoke the marketplace whenever it 'lacks a capability' or when a request merely implies acquiring one, which is an overly broad trigger for a networked acquisition/install skill. This can cause the agent to perform unrequested marketplace searches and potentially progress toward downloading or installing third-party artifacts in response to ordinary user requests, expanding attack surface and violating user intent boundaries.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The 'When to use this skill' section includes broad everyday phrases such as expanding capabilities, installing a new skill, or checking the market before giving up, without strict scope constraints. In practice this encourages opportunistic invocation on ambiguous requests, increasing the chance of unnecessary external calls and steering the agent into acquisition flows the user did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow directs the agent to 'Install locally' by placing artifacts or configuration into runtime locations and potentially reloading the host tool, but it does not require an explicit warning or confirmation before modifying the local environment. That creates a path for silent persistence, configuration tampering, or installation of untrusted third-party content with insufficient user awareness.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The API documentation instructs clients to send the access key as a URL query parameter on every request. Query parameters are commonly exposed in logs, browser history, intermediary systems, analytics, referrer headers, and debugging output, which increases the likelihood of credential disclosure. In the context of an e-store skill that downloads and installs capabilities, compromise of the key could allow unauthorized marketplace access and potentially downstream installation of untrusted assets.

VirusTotal

63/63 vendors flagged this skill as clean.