Security audit

Apo Cli

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real apohealth.de shopping helper, but it needs Review because it can change a health-related shopping cart and stores session data locally without strong protection.

Review before installing. Use it only for deliberate apohealth.de shopping tasks, avoid invoking it for general medical advice, confirm any cart-clearing or checkout handoff yourself, and prefer installing a pinned reviewed revision rather than the README's mutable git command. Be aware that cart cookies and tokens may be written locally in plaintext.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:17
Finding: Unpinned Installation from a Mutable Git Repository
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: apo_cli.py:76
Finding: Session Cookies and Cart Tokens Stored in Plaintext Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file describes add/update/clear cart operations but provides no user-facing warning that these actions modify live session/account state. In an agent skill, this omission is dangerous because an implementer may let natural-language requests trigger unintended cart mutations against a real pharmacy storefront, leading to unauthorized or surprising changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Documenting a cart clear endpoint without any warning or confirmation guidance creates a real safety risk for an agentic CLI, because an implementation may expose a destructive action that wipes user session state with a single call. In this pharmacy context, clearing a cart could remove carefully selected health products and cause user harm or confusion, even if it is not a system-compromise issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation frames checkout/purchase flows as unsuitable for the CLI at L258-L260, but later provides concrete session handling notes and a working addToCart implementation that performs purchase-adjacent state changes. While cart management is separately discussed, the guidance under 'Nicht empfohlen' conflicts with the inclusion of code that operationalizes shopping actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares executable behavior with detected file read, file write, and network capabilities but does not declare any tool scope or permission boundaries. That makes the skill harder to sandbox and review, and can allow broader-than-expected access if the runtime grants default capabilities to skills without explicit restrictions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad and include generic terms like pharmacy, medication, and health products, which can cause the skill to activate in contexts where the user did not intend to shop or disclose product interests. In a health-related domain, unintended invocation increases privacy and safety risk because the agent may steer sensitive conversations into commerce workflows without clear consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill says purchases must never be completed, but the documented interface includes a checkout command that opens the browser for checkout. This creates a policy/implementation mismatch that can lead an agent or user to invoke a checkout-capable path despite the stated safety rule, especially if downstream code does not hard-block that action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTTP headers hard-code Accept-Language: de-DE,de;q=0.9, which imposes a specific language/locale preference on all requests. There is no visible user opt-in, configuration option, or comment explaining why a German locale is required, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes searching products, browsing categories, viewing details, and managing a cart on apohealth.de. In addition to those web interactions, the code invokes webbrowser.open(...), which crosses from remote storefront operations into controlling a local application on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents operations that can affect user data or privacy: checkout opens a browser with the user's cart, and apo cart clear removes cart contents. The README explains how to use these commands but does not include any user warning about opening an external website, transmitting cart data, or clearing cart contents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The recommended HTTP headers explicitly set Accept-Language: de-DE, which forces a specific locale in the skill guidance. This is a natural-language policy issue unless the skill offers user choice or clearly documents and justifies the locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The trigger specification explicitly keys on German-specific terms such as "Apotheke" and "Medikament" alongside site-specific shopping behavior, but does not explain whether the skill is intended only for German-language or Germany-specific pharmacy use. Without a documented opt-in or justified locale restriction, this can create a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: RESEARCH.md:175