Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed eBay research CLI that sends eBay developer credentials only to eBay for OAuth and stores optional watchlists locally, with some broader seller-reference material users should treat as out of scope.
Install only if you are comfortable giving the skill an eBay developer App ID and Cert ID and allowing it to query eBay APIs. Treat the seller API and selling-guide references as informational; do not provide user OAuth seller tokens or authorize listing, fulfillment, or webhook actions unless you intentionally want to go beyond the current research CLI. Be aware that watch commands create or update a local watchlist JSON file, and a custom --state-file path can overwrite that chosen file with watch state.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
token_url = _get_token_url()
credentials = base64.b64encode(f"{app_id}:{cert_id}".encode()).decode()
response = httpx.post(
token_url,
headers={
"Authorization": f"Basic {credentials}",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### `ebay-oauth-python-client` — eBay (official)
**Official OAuth helper from eBay.**
- Handles the OAuth 2.0 flow for getting application and user access tokens
- YAML/JSON config file
- Lightweight — only handles auth, not API calls
- Useful if we ever need user-scoped tokens (e.g., for selling features, watchlist access)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Token | Validity |
|---|---|
| Access token | 2 hours |
| Refresh token | 18 months |
### Token Refresh Example
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
### Document Everything
- Save all messages with the other party.
- Photograph items (serial numbers, condition, packaging) before shipping and after receiving.
- Keep tracking numbers and delivery confirmations.
- Screenshot listings before they can be edited or removed.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def get_app_access_token(scope: str = BROWSE_SCOPE) -> str:
"""
Obtain a client credentials (app-level) OAuth access token.
Fetches a fresh token from eBay's OAuth endpoint each time.
Uses HTTP Basic auth as required by eBay's OAuth 2.0 spec.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def get_app_access_token(scope: str = BROWSE_SCOPE) -> str:
"""
Obtain a client credentials (app-level) OAuth access token.
Fetches a fresh token from eBay's OAuth endpoint each time.
Uses HTTP Basic auth as required by eBay's OAuth 2.0 spec.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def get_app_access_token(scope: str = BROWSE_SCOPE) -> str:
"""
Obtain a client credentials (app-level) OAuth access token.
Fetches a fresh token from eBay's OAuth endpoint each time.
Uses HTTP Basic auth as required by eBay's OAuth 2.0 spec.
The skill documentation advertises use of environment variables, local state files, and eBay REST APIs, but it does not declare an explicit tool/permission scope such as allowed-tools or permissions. That creates a trust gap: an agent may grant broader env, file, and network access than users expect, increasing the chance of unintended secret exposure or filesystem/network misuse if the implementation is compromised or behaves unexpectedly.
The manifest limits the skill to eBay research tasks such as deal search, price evaluation, and fair value estimates. This document repeatedly positions future capabilities like seller data, inventory APIs, fulfillment endpoints, listing creation, seller analytics, and Amazon comparison, which go beyond the stated research-only purpose and indicate a broader operational/commercial scope.
The manifest describes ebay-agent as a research agent for searching deals, evaluating prices, and estimating fair value without requiring an eBay account. However, the documentation recommends future 'seller-side features' including listing creation, inventory management, seller analytics, and OAuth-backed seller capabilities, which are materially different from buyer-side research and require account-scoped operations.
The cheatsheet materially expands the skill from research-only browsing into seller operations, order management, and webhooks. In an agent context, this widens the capability surface beyond the declared purpose and can enable unintended account-affecting actions if the documentation is used to implement or justify those features.
The documentation says no eBay account is required, but also includes authorization-code flows that require user consent and user-level tokens. This mismatch can mislead reviewers and downstream agents about the privileges the skill may request, increasing the risk of over-privileged integrations and unexpected access to account data or actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import httpx
def refresh_access_token(refresh_token, app_id, cert_id):
response = httpx.post(
"https://api.ebay.com/identity/v1/oauth2/token",
auth=(app_id, cert_id),
data={
Inventory item creation, offer creation, and publishing are transactional seller actions that exceed a research/price-evaluation skill's stated scope. In an agent setting, documenting these flows creates a clear pathway for unauthorized or accidental listing creation using user tokens, with financial and reputational consequences.
Fulfillment and shipment-marking APIs can change order state and affect real customer transactions, which is far beyond passive research. Within this skill context, these instructions make the package more dangerous because a supposedly read-only agent could be extended into performing real post-sale actions with user tokens.
The manifest describes an eBay research agent for searching deals, evaluating prices, and estimating fair value using eBay APIs. This CLI also provides a separate saved-watch feature with add/list/remove/check commands and local state-file management, which is a broader alerting/persistence capability not reflected in the stated description.
The watch commands accept a --state-file path override, allowing the skill to read from and write to arbitrary filesystem locations rather than only an internal default state path. For an eBay research and valuation skill, exposing general-purpose file path access is not an obvious requirement of the declared purpose.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Optional
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Optional
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Optional
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
from typing import Optional
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
CONDITION_IDS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
CONDITION_IDS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
CONDITION_IDS = {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import httpx
SANDBOX_BASE_URL = "https://api.sandbox.ebay.com/buy/browse/v1/item_summary/search"
PRODUCTION_BASE_URL = "https://api.ebay.com/buy/browse/v1/item_summary/search"
# Condition ID mapping (eBay codes)
CONDITION_IDS = {
No suspicious patterns detected.