Mercadona Products API

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only skill for an unofficial Mercadona nutrition API; its receipt upload feature has privacy considerations but is disclosed and aligned with the stated purpose.

Before using the receipt endpoint, confirm you are comfortable sending the receipt to the unofficial mercaapi.sgn.space service and downstream AI processing. Prefer product search or manual entry when possible, and avoid uploading receipts that show payment, loyalty, address, barcode, or other unnecessary personal details.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:88

Finding

External Disclosure of Sensitive Receipt Data Without Privacy Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3 and 88–97; downstream Gemini processing is disclosed at lines 250–252
Vulnerability Type: Sensitive Data Exposure
Risk Level: Medium

Vulnerable Code Snippet

markdown

Base URL: `https://mercaapi.sgn.space/api`

markdown

### POST /api/ticket/

Upload a Mercadona receipt (image or PDF) and get AI-extracted product matches
with nutritional stats.

Form data (multipart):
- `file` (file, optional) - image or PDF file
- `url` (str, optional) - URL to fetch the receipt from

One of `file` or `url` is required.

markdown

5. The `/api/ticket/` endpoint uses AI (Gemini) to extract items from receipts
   and match them to products. It returns per-item nutritional stats including
   `cost_per_100g_protein` and `kcal_per_euro` for value analysis.

Technical Analysis

The Skill instructs an agent to send an entire receipt image or PDF to the unofficial external service mercaapi.sgn.space. It also states that Gemini processes the receipt. Receipts may contain purchase history, timestamps, store locations, transaction identifiers, loyalty information, and partial payment information.

External processing is relevant to the declared receipt-analysis feature and is not hidden exfiltration. However, the instructions provide no requirement for informed confirmation immediately before upload, local redaction, data minimization, retention disclosure, deletion controls, or explanation of the parties receiving the document. Uploading the complete document exceeds minimum necessary data exposure when product names, quantities, and prices are the fields required for matching and nutritional analysis.

The alternative url parameter additionally causes the service to retrieve a caller-supplied URL. The server implementation was not included in the audited project, so its SSRF defenses cannot be verified. This is an unverified server-sid ...[truncated 1309 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user confirmation immediately before each upload.
2. Clearly identify mercaapi.sgn.space and Gemini as external processors and explain what data each receives.
3. Warn users that receipts may contain transaction, loyalty, payment, location, and purchasing-profile information.
4. Perform local OCR and redact payment details, loyalty identifiers, transaction numbers, addresses, store locations, barcodes, and other unnecessary metadata before transmission.
5. Transmit only the minimum fields required for product matching, such as product description, quantity, and price, rather than the complete receipt.
6. Document retention duration, deletion procedures, access controls, secondary-use restrictions, and downstream processor policies.
7. Prefer local extraction or a trusted first-party service where feasible.
8. If URL ingestion remains supported, validate the server implementation for SSRF protections, including an HTTP/HTTPS-only scheme allowlist, DNS and redirect revalidation, private/link-local/loopback address blocking, response-size limits, timeouts, and content-type validation.
9. Add a clear opt-out path that allows users to enter receipt items manually without sending the document externally.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents a receipt upload/fetch endpoint that accepts either a file or a remote URL and explicitly notes AI-based processing, but it does not warn users that receipts may contain sensitive personal and transactional data and will be transmitted to an external service. In an agent setting, this omission can cause users or downstream tools to send receipts containing purchase history, timestamps, store location, payment-related metadata, or other personal information without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.