WordPress/WooCommerce Connector Lite

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:31 AM UTC
• Version: 1.0.1

Overview

This WooCommerce connector is purpose-aligned, but it handles store secrets and customer/order data without enforcing HTTPS or strong replay-resistant request signing.

Review before installing. Use this only with an HTTPS WooCommerce URL, protect OPENCLAW_STORE_SECRET like a credential, and avoid giving the agent access to stores where reading arbitrary order/customer details would be inappropriate. Pin dependencies or install from a locked, reviewed dependency set if possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/index.js:12

Finding

HTTPS Is Not Enforced for Sensitive WooCommerce Traffic

Content

View full analysis

{ try { const url = `${OPENCLAW_STORE_URL}/wp-json/openclaw/v1/system/status`; const response = await axios.get(url); ``` ### Technical Analysis `OPENCLAW_STORE_URL` is taken directly from the environment and used to construct network destinations without parsing the URL or requiring the `https:` protocol. Although the documented example uses HTTPS, the implementation accepts an HTTP URL. The authenticated endpoints return order and customer information, including customer names, order contents, totals, dates, and status. When HTTP is used, request payloads, HMAC signatures, and response data are transmitted without transport confidentiality or server authentication. HMAC signing provides message authentication but does not encrypt traffic or prevent passive observation. The network communication is necessary for the declared WooCommerce connector functionality and is sent only to the operator-configured store. However, allowing plaintext transport exceeds secure minimum requirements for processing ...[truncated 1134 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/index.js:14

Finding

HMAC-Signed API Requests Lack Replay Protection and Endpoint Binding

Content

View full analysis

Remediation

View remediation

``` The client and companion WordPress plugin must be updated together. Authentication should fail closed if any signed component is missing, malformed, expired, or inconsistent with the received request. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares required environment variables, including a store secret, but does not define any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder to constrain how the skill may access sensitive configuration at runtime, increasing the risk of unintended secret exposure or broader-than-necessary capability use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code reads OPENCLAW_STORE_SECRET from process.env and uses it to authenticate requests, but there is no user-facing warning, log, or disclosure that the skill depends on sensitive credentials. Under the code-file criteria, accessing credentials can warrant a finding when the operation is otherwise undisclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JavaScript code posts payloads to a remote store API via axios, including order IDs and product queries, but there is no confirmation prompt, logging, or user-facing notice that data is being sent off-host. For code files, remote transmission of user or system data should have some visible disclosure unless clearly covered elsewhere; this file only has developer comments/docstrings.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a caret range ("^1.6.0") rather than being pinned to an exact version, which makes builds non-reproducible and can silently introduce vulnerable or malicious upstream releases during installation. In a connector skill that makes outbound network requests to a WooCommerce store, dependency drift in the HTTP client increases supply-chain risk and can change security behavior without code changes.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "OpenClaw skill for WooCommerce integration",
  "main": "index.js",
  "dependencies": {
    "axios": "^1.6.0"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The manifest references axios without pinning an exact version, while the package has multiple known advisories across versions; this makes it impossible to verify at audit time whether installs will resolve to a safe release. Because this skill is a WooCommerce connector that likely performs authenticated HTTP requests and may process store data, an affected axios version could expose SSRF, request manipulation, credential leakage, or response tampering depending on runtime usage.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/index.js:5