Walmart

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:50 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Walmart shopping assistant that uses local planning notes and user-confirmed Walmart workflows without hidden execution or credential collection.

Install only if you are comfortable letting the skill keep Walmart planning notes in ~/walmart/ and, when you choose active mode, use your Walmart session for cart and order workflows. Keep it in planning-only mode unless you want browser-assisted actions, and review carefully before confirming purchases, cancellations, substitutions, address changes, or pharmacy-related steps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Memory Manipulation

High

• Category: Memory Poisoning

Content

|-- memory.md           # Household profile, store preferences, and substitution rules
|-- weekly-cart.md      # Current basket with must-have vs optional items
|-- order-log.md        # Prior orders, missing items, and substitution outcomes
|-- exceptions.md       # Allergy, pharmacy, age-restricted, and never-substitute rules
`-- archive/            # Past carts and resolved delivery issues
```

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

- Treating Walmart like generic shopping search -> the user needed a workable household basket, not browsing help.
- Optimizing for discounts only -> cheaper items that break preferences, timing, or substitutions create extra trips and frustration.
- Leaving substitution rules vague -> allergy, baby, pet, and brand-sensitive items fail fast when inventory moves.
- Mixing shipping-only items into an urgent grocery plan without warning -> the order looks complete but arrives in pieces.
- Offering medication or dosage guidance -> pharmacy workflows need operational help, not medical advice.
- Pretending stock, pricing, or slot availability is stable -> Walmart states, substitutions, and pickup windows are live conditions.

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- For repeat planning: permission to keep local notes in `~/walmart/`
- For pharmacy-related tasks: explicit user confirmation before any refill or account change workflow

Never ask the user to paste passwords, payment credentials, insurance details, or prescription identifiers into chat.

## Automation Scope

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Block by Default

Never auto-approve substitutions for:
- allergy-sensitive foods
- baby formula, infant food, or medically sensitive products
- pet food when the animal has a known brand or ingredient restriction

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Block by Default

Never auto-approve substitutions for:
- allergy-sensitive foods
- baby formula, infant food, or medically sensitive products
- pet food when the animal has a known brand or ingredient restriction

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.