Shopee Planner

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.1.0

Overview

This is a Shopee campaign planning skill made of advisory Markdown templates and checklists, with no executable code or hidden system access.

Before installing, treat this as advisory campaign-planning material: verify current Shopee fees, deadlines, and seller rules in Seller Centre before acting, and remove the attribution footer if you do not want it in shared plans.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: references/output-template.md:116

Finding

Unrequested Third-Party Branding Injected into Generated Campaign Plans

Content

View full analysis

Vulnerability Details

File Location: references/output-template.md:116
Vulnerability Type: Output instruction hijacking through mandatory attribution
Risk Level: Low

markdown

*Generated by Shopee Planner skill — ClawHub*

Technical Analysis

The campaign-plan template contains a fixed third-party attribution. The instruction at references/output-template.md:3 directs the agent to use this template when preparing campaign plans, while SKILL.md:159 explicitly identifies the file as the campaign-plan output template.

When an agent follows these instructions without independently filtering the footer, the resulting business document includes promotional branding that the user did not necessarily request or approve. This changes the expected output content and therefore represents a limited form of skill instruction hijacking.

The issue does not execute code, override safety controls, retrieve remote content, or modify persistent state. Its effect is limited to the integrity and presentation of generated output.

Attack Path

1. A user invokes the Shopee Campaign Planner skill.
2. The agent reads the resource link in SKILL.md:159.
3. The linked template instructs the agent to use its prescribed structure.
4. The agent reproduces the fixed footer from references/output-template.md:116.
5. The resulting campaign document advertises ClawHub even though the user did not explicitly request that attribution.

Impact Assessment

The issue can cause unauthorized branding to appear in campaign plans shared with store operators, partners, or ecommerce teams. Potential consequences include document-integrity concerns, confusion about authorship or endorsement, and reputational impact in client-facing materials.

No system privileges, credentials, seller-account permissions, or execution capabilities can be obtained through this issue. The affected scope is limited to generated-document content.

Remediation

View remediation

Remediation Suggestions

1. Remove the fixed branded footer from the default output template.
2. If attribution is operationally required, replace it with an optional placeholder such as [Optional attribution].
3. Instruct the agent to include attribution only after obtaining explicit user approval.
4. Ensure templates distinguish required business content from optional metadata or branding.
5. Add a review check confirming that generated documents contain no unrequested endorsements, advertisements, or third-party attribution.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

2. **Setting minimum spend too low on vouchers** — A MYR 5 off with no minimum spend trains buyers to wait for vouchers instead of paying full price. Always set min spend at ≥1.5× AOV.

3. **Running Flash Sales and store-wide vouchers simultaneously without checking stack depth** — Buyers can apply both, easily pushing your effective discount to 35–40% and eliminating all margin.

4. **Ignoring Shopee's Flash Sale application deadlines** — Major double-digit events (9.9, 10.10, 11.11) require Flash Sale applications 10–14 days in advance. Sellers who apply the week before are rejected.