ClawHub
Back to skill

Security audit

Instacart

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Instacart integration guide that uses expected Instacart APIs and local notes, with no evidence of hidden, destructive, or unrelated behavior.

Install this only if you intend to use Instacart integration workflows and are comfortable sending recipe, shopping-list, retailer lookup, and MCP payload data to Instacart. Keep INSTACART_API_KEY in environment variables or a secret manager, do not store it in ~/instacart/ notes, and review the activation preference so the skill only engages for the Instacart tasks you want.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- Optional tool for MCP Inspector workflows: `npx`
- Optional: MCP Inspector for validating MCP connectivity

Never ask the user to paste API keys into chat. Use environment variables or their existing secret manager.

## Data Storage

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
- assume a new production key is non-functional while pending approval
- keep public messaging and logo usage aligned with Instacart guidelines

Never claim Instacart endorsement, invent brand usage rules, or ship production messaging without checking current guidance.

## Common Traps

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file includes curl examples that send recipe and shopping-list payloads to remote Instacart endpoints and authenticate with the INSTACART_API_KEY environment variable. The surrounding documentation does not warn readers that using these examples will transmit data off-system and require handling of API credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · request-patterns.md (reported line 6)May include surrounding context.

Recipe Page Pattern

bash
curl -s "https://connect.dev.instacart.tools/idp/v1/products/recipe" \
  -H "Authorization: Bearer $INSTACART_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · request-patterns.md (reported line 35)May include surrounding context.

Shopping List Pattern

bash
curl -s "https://connect.dev.instacart.tools/idp/v1/products/products_link" \
  -H "Authorization: Bearer $INSTACART_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The setup instructions define activation using broad, everyday concepts like 'Instacart, recipe pages, shopping lists, or retailer lookups,' which can cause the skill to trigger in loosely related conversations. This creates an overbroad invocation boundary that may inappropriately steer user interactions, persist memory about activation preferences, and increase the chance of unintended use of commerce-oriented guidance in contexts where the user did not explicitly request it.

Content

No source excerpt is available for this finding.