ClawHub
Back to skill

Security audit

Knuspr

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Knuspr grocery-shopping helper, but it can access a live account and change carts, lists, favorites, and delivery reservations.

Install only if you are comfortable letting an agent use your Knuspr account for shopping workflows. Prefer interactive login, avoid passing passwords on the command line, tightly protect or avoid ~/.knuspr_credentials.json, confirm any cart/list/favorite/slot changes, and personally review checkout in Knuspr before buying.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and uses capabilities such as environment variable access, file writing, and network communication without declaring permissions. In this context, those capabilities can expose credentials, persist session tokens/cookies locally, and interact with a real shopping account, reducing transparency and weakening consent boundaries for users and the platform.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description understates the full behavior of the bundled CLI by omitting credential/session handling, local cookie storage, account-data retrieval, browser opening, shell completion generation, and broader account/order functionality. This mismatch is dangerous because users and orchestrators may invoke the skill under a narrower trust assumption while it can access more sensitive account data and perform side effects beyond the declared grocery-assistant scope.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The README prominently documents account-affecting and potentially destructive commands such as cart clearing, slot reservation/release, favorite removal, and order repetition, but it does not consistently warn that these actions modify a real customer account or may trigger purchases and reservation changes. In an AI-agent context, this increases the chance of unintended state-changing actions being executed from natural-language requests without explicit user confirmation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The credential setup section instructs users to export passwords in environment variables and store plaintext credentials in a JSON file, but it does not clearly warn about the security risks of shell history leakage, process/environment exposure, backups, or local file compromise. Because this skill is designed for automation and AI agents, such storage patterns make credential theft or accidental disclosure more likely.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger text includes broad, everyday phrases like groceries, shopping list tasks, and related German terms, which increases the chance of accidental invocation in normal conversation. In a skill that can access a real commerce account, reserve delivery slots, modify carts, and use stored credentials, unintended activation raises the risk of privacy exposure and unwanted account actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The client loads credentials from environment variables and a plaintext file in the user's home directory, which creates a local secret exposure risk if the host is multi-user, backed up, logged, or otherwise inspected. In an agent-skill context, this is especially sensitive because users may not realize the skill is encouraging persistent credential storage outside a protected keychain.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Session cookies plus user/account identifiers are persisted to a local JSON file without permission hardening or clear user notice, so theft of that file may enable account hijacking or privacy leakage. In a CLI/agent environment, unattended execution and shared workstations make silent token persistence more dangerous than in a purely interactive app.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explicitly advertises password-bearing CLI flags (`-p pass`) and identifies environment variables and a credential file path without any warning about shell history, process listing, logging, or file-permission risks. In an agent skill context, this is more dangerous because an automated agent may pass secrets non-interactively, surface them in telemetry, or normalize insecure credential handling patterns for downstream tools and prompts.

Credential Access

High
Category
Privilege Escalation
Content
# Configuration
BASE_URL = "https://www.knuspr.de"
SESSION_FILE = Path.home() / ".knuspr_session.json"
CREDENTIALS_FILE = Path.home() / ".knuspr_credentials.json"
CONFIG_FILE = Path.home() / ".knuspr_config.json"

# Exit codes
Confidence
96% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
| `auth status` | Check login status |

Env vars: `KNUSPR_EMAIL`, `KNUSPR_PASSWORD`
Credential file: `~/.knuspr_credentials.json`
Confidence
90% confidence
Finding
credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.