ClawHub
Back to skill

Security audit

shopify-operations-brief

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent read-only Shopify reporting skill, but its local CLI and file-output handling create review-worthy command-execution and file-write risks in some environments.

Review this skill before installing, especially on Windows or shared workspaces. Use a merchant-owned read-only Shopify connection, keep skill-hub.env in a private directory, avoid attacker-controlled working directories, avoid custom Shopify CLI paths unless trusted, and treat generated reports as private merchant data.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/shopify-operations-brief.mjs:102
Finding

Symbolic-Link Bypass Allows Report Writes Outside the Working Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/auth.mjs:232
Finding

Windows Shell Execution Exposes Configurable Shopify CLI Arguments to Command Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/shopify-operations-brief.mjs:118
Finding

Credential Template Is Created Without Restrictive Permissions or Atomic No-Follow Semantics

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/lib/auth.mjs (reported line 162)May include surrounding context.

js
const resolvedVersion = response.headers['x-shopify-api-version'];
        if (resolvedVersion && resolvedVersion !== apiVersion) {
          reject(new Error(`API_VERSION_MISMATCH: Requested ${apiVersion}, Shopify used ${resolvedVersion}. Update SKILL_HUB_SHOPIFY_API_VERSION before retrying.`));
          return;
        }
        if (response.statusCode >= 400) {

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/html-renderer.mjs (reported line 552)May include surrounding context.

js
</head>
<body>
  <div class="container">
    <!-- Header -->
    <header class="header">
      <div>
        <div class="store-badge">

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file specifies visible labels using fixed Chinese/English text and priority labels, but does not state that the user can choose a language or that the bilingual requirement is limited to a justified regional context. This creates a natural-language locale policy concern because the output language format is imposed rather than offered as an opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The function defaults lang to zh-CN, which causes generated summaries and recommendations to be in Chinese unless the caller explicitly overrides it. This imposes a specific locale by default rather than offering a neutral default or explicit user choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes a read-only store performance overview skill, but this file implements subprocess execution via execFile and invokes shopify store auth and shopify store execute. Spawning an external CLI is a broader capability than simple read-only analytics access and is not declared in the skill description as part of its scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The code pulls abandoned checkout records, which go beyond a simple operational performance summary and enter conversion/marketing analysis territory. While the fields shown are limited, collecting this dataset without a clearly justified need increases access to customer-behavior data and broadens the skill's effective capability beyond its declared purpose. The skill context makes this somewhat less dangerous than a write-capable marketing tool, but the scope expansion is still meaningful.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is described as a period-based read-only performance brief, but it unconditionally fetches all active products and inventory for the entire store. That creates unnecessary overcollection beyond the stated purpose and expands exposure of commercially sensitive inventory data if the output, logs, or downstream processing are mishandled. In this context, the read-only nature reduces severity, but the mismatch between declared scope and actual data access is still a real data-minimization issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The function signature sets lang = 'zh-CN', and the HTML language is then derived from that value, causing the skill to default to a specific locale when no user choice is provided. This is a natural-language policy concern because the file forces a language/locale preference rather than offering neutral fallback or explicit user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI defaults lang to zh-CN, which means generated summaries and report output will use a specific locale unless the user explicitly overrides it. This imposes a language choice by default rather than offering a neutral or opt-in selection, matching the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The example command explicitly passes --lang zh-CN, which indicates a specific language/locale setting. In this markdown file, there is no nearby statement that language choice is optional or that Chinese output is required for a region-specific use case, so this can be read as a default or recommended forced locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

If no local env file exists, loadEnvFile returns a copy of all process.env values. For a skill intended only to generate a read-only Shopify operations brief, broad access to the host process environment is unnecessary and expands its capability beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The locale helper falls back to 'zh-CN' for any language value that is missing or does not start with 'en'. This imposes a specific language choice by default rather than offering a neutral selection or explicit user opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file uses fixed locales such as 'en-CA' and 'en-US' for date formatting and later recognizes only English and Chinese natural-language period phrases. This imposes a language/locale assumption without any user opt-in or documented choice, which matches the policy category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language branches match phrases like 'yesterday', 'today', 'last-week', Chinese date expressions, and English month names, but there is no mechanism for users to choose or discover supported languages. This is a natural-language policy concern because the skill behavior is language-constrained without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/test-shopify-operations-brief.mjs:134