Security audit

Bytesagain Ecom Ops

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed e-commerce analytics helper with low-impact input-validation issues but no evidence of hidden access, exfiltration, destructive behavior, or privilege abuse.

Reasonable to install if you want local e-commerce metric calculations. Treat outputs as advisory, avoid passing sensitive customer data unless needed, and be aware that invalid or zero numeric inputs may cause commands to fail instead of returning clean errors.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:55
Finding: Unvalidated Numeric Inputs Cause Denial of Service
Content: View full analysis
0 else 0 mer = revenue / spend # Marketing Efficiency Ratio breakeven_roas = 1 / (1 - cogs_pct/100 - fee_pct) ``` ```python current_margin = (current - cost) / current * 100 if current > 0 else 0 target_price = cost / (1 - target_margin/100) comp_margin = (comp - cost) / comp * 100 if comp > 0 else 0 print(f"\n{'═'*50}") print(f"PRICING ANALYSIS") print(f"{'═'*50}\n") print(f" Cost: ${cost:.2f}") print(f" Current Price: ${current:.2f} (margin: {current_margin:.1f}%)") print(f" Competitor Price: ${comp:.2f} (their margin est: {comp_margin:.1f}%)") print(f" Target Margin: {target_margin:.0f}%") print() print(f" TARGET PRICE: ${target_price:.2f}") print() print(" PRICING STRATEGY OPTIONS:") if target_price > comp * 1.1: print(f" → Premium pricing at ${target_price:.2f} (+{(target_price/comp-1)*100:.0f}% vs competitor)") print(f" Requires strong differentiation (brand, reviews, features)") elif target_price < comp * 0.95: print(f" → Competitive pricing at ${target_price:.2f} (-{(1-target_price/comp)*100:.0f}% vs competitor)") ``` ### Technical Analysis Numeric command-line parameters are converted to Python numeric types without comprehensive validation. Several user-controlled values are subsequently used as divisors without ensuring that they are nonzero and within valid business ranges. The Bash variables are commonly initialized to `0`, while checks such as `[[ -z "$spend" ]]` only test whether a string is empty. The string `"0"` and default value `0` therefore pass these checks. Relevant failur ...[truncated 2131 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes outputs limited to attribution analysis, ad ROI report, inventory reorder plan, and pricing recommendations. The code also provides customer cohort retention/LTV analysis and conversion funnel analysis, which are additional analytics capabilities not reflected in the stated description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.