Back to skill

Security audit

Shop on Dell - Give your Claw Agent a credit card

Security checks for vulnerabilities and agentic risk

Overview

This is a Dell shopping and support reference skill with no code, credentials, persistence, or transaction authority, though its description overstates purchase capability.

Before installing, understand that this skill is an informational Dell product and support guide, not an in-skill purchasing or payment tool. Use official Dell channels for pricing, orders, financing, and support, and share device Service Tags only when needed for device-specific support.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description claims the skill covers browsing and purchasing PCs, servers, monitors, and infrastructure. However, the documentation later states that the skill provides informational guidance only and that purchases should be made through dell.com, Dell sales, or authorized resellers, indicating the skill itself does not perform purchasing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's own documentation is internally inconsistent about the skill's intent. Earlier documentation and manifest text position the skill as supporting purchases, while the Important Notes section directly says it provides informational guidance only and that purchases should occur outside the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase 'When purchasing a Dell PC for your owner' presumes and enforces a particular user relationship and terminology rather than offering neutral language or a user choice. This is a natural-language policy concern because it hard-codes an organization-specific framing into the skill content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.