T09 · Insecure Skill Coding Practices
Error
- Location
src/cli/index.js:65- Finding
Unrestricted UCP Discovery and Profile-Controlled REST Endpoint Enable SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
a2a supermarket
Security checks for vulnerabilities and agentic risk
Overview
This commerce skill does what it says at a basic level, but its networked marketplace actions are too broadly scoped for automatic use without review.
Review before installing. Use only with trusted marketplace domains, prefer explicit HTTPS URLs, and avoid running it in privileged or internal-network environments until domain allowlisting, endpoint validation, HTTPS-only behavior, and confirmation for seller publish actions are added.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/cli/index.js:65- Finding
Automatic HTTPS-to-HTTP Fallback Permits Discovery Profile Tampering
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill claims to be a unified end-to-end commerce orchestrator, including payments and order lifecycle handling, but the file itself says the current implementation is only an early-launch scaffold with direct seller publish and buyer discovery actions. This description-behavior mismatch is dangerous because operators may trust it with broader, higher-risk workflows than are actually implemented, leading to unsafe assumptions about authentication, payment handling, state transitions, and business controls.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/cli/index.js --role seller --domain 127.0.0.1:3456 --name "Skill Chair" --price-minor-units 12999 --category Furniture
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/cli/index.js --role seller --domain 127.0.0.1:3456 --name "Skill Chair" --price-minor-units 12999 --category Furniture
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/cli/index.js --role seller --domain 127.0.0.1:3456 --name "Skill Chair" --price-minor-units 12999 --category Furniture
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises executable CLI flows that connect to a market domain and perform buyer/seller operations, but it does not declare any permissions or allowed-tools scope. That mismatch weakens security boundaries because an agent or reviewer cannot reliably tell that networked, data-affecting actions are expected, increasing the chance of unintended external communication or unsafe execution in permissive runtimes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill describes marketplace publishing, discovery, payment authorization, and order orchestration capabilities without clear user-facing warnings that these actions can affect external data, listings, orders, or financial state. In a commerce context, missing warnings are more dangerous because users or calling agents may trigger irreversible or costly operations without adequate confirmation or risk awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code sends product data to a discovered remote endpoint using an HTTP POST, which is a state-changing network operation. There is no confirmation prompt, warning message, or explanatory comment/docstring in this file disclosing that seller mode will publish data to an external service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill automatically performs outbound requests to user-supplied domains and follows discovered UCP service metadata to a remote REST endpoint, including fallback to plain HTTP. This enables server-side request behavior against arbitrary hosts and can expose the environment to unintended internal network access, metadata probing, or traffic interception when used in trusted automation contexts.
- Content
Static analysis
No suspicious patterns detected.