Security audit

Neway Commerce OS

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent commerce-site scaffold, but it needs Review because it can delete an existing output project without confirmation and its payment/security scaffolding can be mistaken for production-ready checkout.

Install only if you are comfortable reviewing the generated project before use. Do not run the scaffold script against a directory containing valuable work unless you have a backup, treat checkout and Stripe/webhook code as demo placeholders until you implement real payment verification, and avoid sending customer, payment, or business-sensitive data to any AI provider without explicit privacy controls.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (16)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to execute host shell commands to read the system locale, which accesses host-specific information unrelated to the minimum necessary user prompt. Even if low sensitivity, this normalizes environment probing and can expose user or system metadata without consent.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill requires running npm install/build and starting a dev server locally, which launches subprocesses and may execute arbitrary package lifecycle scripts from generated or template content. This expands the skill from text/code generation into code execution on the host, increasing supply-chain and local-environment risk.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill mandates outbound HTTP requests to validate image URLs and replace them with third-party Unsplash URLs, causing network activity that the user may not expect. Such requests can leak information about the project, environment, or usage patterns and introduce third-party content dependency into generated output.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The UI asserts 'Secure checkout with SSL encryption' even though this component does not perform any payment processing, transport verification, or security-state detection. In an ecommerce checkout skill, this can mislead users into trusting a security property that is not actually enforced or evidenced by the code, creating deceptive security signaling.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The page presents WeChat Pay, Alipay, and Bank Card as if they are functional payment options, but final submission only waits, generates an order ID, and clears the cart without charging the user or redirecting to a payment provider. In a commerce OS template, this is dangerous because operators may deploy it believing payments are handled, causing fake orders, revenue loss, accounting errors, and customer deception.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README instructs users to connect an external AI API using environment variables and send requests from an assistant endpoint, but it does not warn that user prompts, commerce data, or other request contents may be transmitted to third-party providers. In a commerce context, this can lead to unintentional disclosure of customer or business data and weak consent/privacy handling.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The production Stripe setup discusses real checkout sessions, webhooks, and secrets but does not prominently warn about handling live transactions, protecting Stripe secrets, and validating webhook authenticity. In a deployment-oriented skill, this omission increases the chance that users will move from mock to production without sufficient security controls.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The README encourages invoking the skill with extremely broad, one-sentence natural-language prompts and claims the bot will automatically analyze requirements and generate the full project. In an agentic code-generation context, this weakens scope control and increases the chance of prompt injection, unsafe generation, or unintended actions because there are no explicit boundaries on allowed inputs, outputs, or side effects.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The README states that UI language is chosen automatically from the system locale, which implies behavior based on host or client environment rather than explicit user selection. While not a direct code-execution flaw, it can create privacy and consent issues and may produce incorrect or surprising behavior when locale-derived preferences are inferred without opt-in.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to access local system locale information without warning the user, creating a transparency and consent failure. Hidden collection of host metadata is dangerous because users cannot make an informed decision about what local information the skill will inspect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill performs external HTTP requests for image validation and replacement without notifying the user, which is undisclosed network activity. This is risky because external requests may reveal project context or simply violate user expectations for an offline scaffolding task.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to run build and preview commands locally but does not warn the user that subprocesses and long-running services will be started. Undisclosed command execution can surprise users, consume resources, open local ports, or run package scripts with side effects.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The workflow forces English for all non-zh locales rather than honoring the user's actual preferred language, which is a trust and product-safety issue. While not a direct system compromise, it can cause incorrect localization, miscommunication in checkout or admin flows, and user confusion in generated commerce sites.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: Mandating English output for every non-Chinese locale overrides user preferences and produces misleading localization behavior. In a commerce context, wrong language defaults can degrade usability and cause misunderstandings in payment, shipping, or legal text.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The scaffold unconditionally calls shutil.rmtree(output_dir) if the target directory already exists, which can destroy existing project files without any confirmation, backup, or safety guard. Because the output path is user-controlled and only combined with a slug, a mistaken or reused output directory can lead to irreversible data loss during normal use of the skill.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The locale-detection workflow reads host environment data that is not necessary for storefront scaffolding and exposes user/system-specific attributes to the agent. Even though locale is not highly sensitive on its own, the pattern is dangerous because it broadens data access beyond task requirements and encourages host reconnaissance behaviors.

Static analysis

No suspicious patterns detected.