Security audit

Apo Cli

Security checks across malware telemetry and agentic risk

Overview

This is a coherent apohealth.de shopping-cart helper, but users should understand it can change a live cart and stores session data locally.

Install only if you want agent-assisted apohealth.de product lookup and cart management. Do not use it for medical advice, review any add/remove/clear action before it runs, complete checkout yourself in the browser, and treat apo_cookies.json and apo_cart.json as private session files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes a bundled Python CLI and explicitly documents capabilities that imply network access and cart state management, yet it declares no permissions or capability boundaries. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot reliably assess what the skill is allowed to do, increasing the risk of unintended file, network, or stateful actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The document exposes and encourages use of a Storefront API access token, even if it is described as publicly embedded in HTML. Embedding operational credentials in skill research expands the skill’s capabilities beyond simple search/cart discovery, normalizes token reuse, and can enable unintended API access paths or future scope creep if the token permissions change.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The research says checkout/purchase is not recommended because it requires complex authenticated flows, while the skill metadata claims it can order pharmacy products. This mismatch is dangerous because users and downstream agents may believe the skill is authorized to complete purchases when the documented implementation only supports cart manipulation, creating a risk of deceptive or unsafe transaction behavior in a sensitive pharmacy context.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation states the user cannot open a browser from the agent and therefore should receive a cart URL, but elsewhere exposes a `cart checkout` action explicitly described as opening a browser. This contradiction can cause an agent to choose an unsafe execution path, undermining the stated safety boundary and potentially triggering external actions the user did not intend.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Documenting a checkout capability that opens a browser conflicts with the skill's own rule to never complete a purchase and expands the action surface from informational/cart management into transaction initiation. In a commerce or pharmacy context, even opening the checkout flow can facilitate unintended purchases, privacy exposure, or user confusion about what the agent is authorized to do.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document provides direct cart-modifying endpoints and example payloads without prominent warning that these actions affect a live session-bound shopping cart. In a pharmacy setting, silent cart additions, updates, or clears can alter intended medication purchases and create safety, privacy, and user-trust issues.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: Hard-coding Accept-Language to de-DE forces a locale choice without user consent or documented necessity. While lower severity, this can misrepresent user preferences, affect product or regulatory content presentation, and produce misleading search or product information for users in other locales.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger terms are broad enough to activate on ordinary health or medication discussion, not just clear shopping intent. Over-broad activation increases the chance the commerce skill is invoked in sensitive medical conversations, which can lead to unnecessary data exposure, irrelevant tool use, or inappropriate nudging toward product search/purchase flows.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill persists session cookies to a local JSON file without any user warning, consent flow, or file-permission hardening. On a shared machine or in a multi-tenant agent/runtime environment, those cookies could be read by another local user or process and reused to access the same apohealth session or infer sensitive pharmacy-shopping activity.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The cart token is written to disk without user notice or protection. While typically less sensitive than authentication cookies, it can still expose shopping-session state and may allow cart manipulation or correlation of a user's medication/product interests if another local actor can read the file.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: RESEARCH.md:175