ClawHub
Back to skill

Security audit

Instacart

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Instacart integration guide that uses expected Instacart APIs and local notes, with no evidence of hidden, destructive, or unrelated behavior.

Install this only if you intend to use Instacart integration workflows and are comfortable sending recipe, shopping-list, retailer lookup, and MCP payload data to Instacart. Keep INSTACART_API_KEY in environment variables or a secret manager, do not store it in ~/instacart/ notes, and review the activation preference so the skill only engages for the Instacart tasks you want.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Optional tool for MCP Inspector workflows: `npx`
- Optional: MCP Inspector for validating MCP connectivity

Never ask the user to paste API keys into chat. Use environment variables or their existing secret manager.

## Data Storage
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- assume a new production key is non-functional while pending approval
- keep public messaging and logo usage aligned with Instacart guidelines

Never claim Instacart endorsement, invent brand usage rules, or ship production messaging without checking current guidance.

## Common Traps
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This markdown file includes curl examples that send recipe and shopping-list payloads to remote Instacart endpoints and authenticate with the INSTACART_API_KEY environment variable. The surrounding documentation does not warn readers that using these examples will transmit data off-system and require handling of API credentials.

External Transmission

Medium
Category
Data Exfiltration
Content
## Recipe Page Pattern

```bash
curl -s "https://connect.dev.instacart.tools/idp/v1/products/recipe" \
  -H "Authorization: Bearer $INSTACART_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
## Shopping List Pattern

```bash
curl -s "https://connect.dev.instacart.tools/idp/v1/products/products_link" \
  -H "Authorization: Bearer $INSTACART_API_KEY" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The setup instructions define activation using broad, everyday concepts like 'Instacart, recipe pages, shopping lists, or retailer lookups,' which can cause the skill to trigger in loosely related conversations. This creates an overbroad invocation boundary that may inappropriately steer user interactions, persist memory about activation preferences, and increase the chance of unintended use of commerce-oriented guidance in contexts where the user did not explicitly request it.

Static analysis

No suspicious patterns detected.