WPClaw Lite (WordPress/WooCommerce connector)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:37 AM UTC
• Version: 1.0.0

Overview

This is a real WooCommerce connector, but it needs review because it can expose detailed customer orders through a shared store secret without built-in user authorization or HTTPS enforcement.

Install only for trusted store operators or admin-only agents. Require HTTPS in WPCLAW_STORE_URL, use narrowly scoped credentials if possible, add backend caller authorization and rate limits, redact unnecessary customer fields, and pin dependencies with a reviewed lockfile before production use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/index.js:46

Finding

Insufficient authorization controls expose customer order information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4; scripts/index.js:46-54
Vulnerability Type: Missing caller-level authorization and excessive privilege
Risk Level: High

Vulnerable Code

yaml

user-invocable: true

js

check_order: async ({ id }) => {
    try {
        if (!id) throw new Error('Order ID is required.');
        
        const order = await callWoo('/orders/get', { id: parseInt(id) });
        
        let output = `📦 Order #${order.id} | Status: ${order.status} | Total: ${order.currency} ${order.total}\n`;
        output += `Date: ${order.date_created}\n`;
        output += `Customer: ${order.billing.first_name || ''} ${order.billing.last_name || ''}\n`;

Technical Analysis

The user-invocable check_order tool accepts an arbitrary order ID and uses the server-side WPCLAW_STORE_SECRET to issue a privileged, signed request. It does not verify the caller's identity, role, store affiliation, or ownership of the requested order.

WooCommerce order identifiers are commonly numeric and may be predictable. The validation also only checks whether id is truthy before passing it to parseInt; it does not require a canonical positive integer. Authorization is therefore delegated entirely to possession of the Skill's shared store credential, even though callers do not personally possess that credential.

The response exposes the order number, status, total, creation date, customer first and last name, and purchased line items. This exceeds least privilege if the Skill is available to untrusted users rather than exclusively to authorized store operators.

Attack Path

1. An untrusted or insufficiently privileged user obtains permission to invoke the Skill.
2. The user calls check_order with a guessed numeric order ID.
3. The Skill signs the request with the privileged store secret.
4. The WooCommerce connector treats the request as authorized and returns t ...[truncated 685 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict check_order to authenticated store administrators or explicitly trusted operational roles.
• Pass verified caller identity and authorization context to the backend rather than relying solely on a shared Skill credential.
• Enforce order ownership or role-based access on the WordPress connector before returning order data.
• Require id to be a canonical, positive, safe integer; reject partial numeric strings, negative values, zero, and values outside the expected range.
• Add rate limits, enumeration detection, audit logging, and alerts for repeated failed or sequential order queries.
• Return only fields necessary for the caller's task. Redact customer names and purchase details when they are not required.
• Use separate credentials with narrowly scoped permissions for order lookup, product search, and status checks.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/index.js:13

Finding

Authenticated store requests do not enforce encrypted HTTPS transport

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12; scripts/index.js:13-29
Vulnerability Type: Plaintext transmission of sensitive store requests and responses
Risk Level: Medium

Vulnerable Code

js

async function callWoo(endpoint, payload) {
    try {
        const url = `${WPCLAW_STORE_URL}/wp-json/wpclaw/v1${endpoint}`;
        const body = JSON.stringify(payload);

        // Generate HMAC-SHA256 Signature
        const signature = crypto
            .createHmac('sha256', WPCLAW_STORE_SECRET)
            .update(body)
            .digest('hex');

        const config = {
            headers: {
                'Content-Type': 'application/json',
                'X-WPClaw-Signature': signature
            }
        };

        const response = await axios.post(url, body, config);
        return response.data;

The documented configuration accepts a full URL without requiring HTTPS:

md

*   `WPCLAW_STORE_URL`: The full URL of your WordPress site (e.g., https://example.com).

Technical Analysis

WPCLAW_STORE_URL is accepted directly from the environment and concatenated into request URLs without parsing or validating its scheme. Consequently, a value beginning with http:// causes order identifiers, product queries, HMAC signatures, and API responses to cross the network without transport encryption.

HMAC-SHA256 authenticates the signed body but does not provide confidentiality. It also does not prevent replay by itself. The client includes no timestamp, nonce, or unique request identifier in the signed payload. A network observer who captures a plaintext request may therefore read its contents and attempt to replay the same body and signature if the backend lacks independent replay protection.

Axios redirect behavior is not constrained in the supplied configuration. Redirect destinations should also be controlled so requests are not unintentionally moved f ...[truncated 1080 chars]

Remediation

View remediation

Remediation Suggestions

• Parse WPCLAW_STORE_URL with the standard URL API and require the https: protocol before making any request.
• Reject URLs containing embedded usernames or passwords.
• Maintain an explicit allowlist of expected store hostnames where deployment architecture permits it.
• Disable redirects or validate every redirect destination, requiring the same approved HTTPS origin.
• Retain normal TLS certificate and hostname validation; do not permit insecure certificate bypasses.
• Add a timestamp, nonce, HTTP method, and canonical request path to the authenticated material.
• Have the server reject expired timestamps and previously used nonces to prevent replay.
• Document HTTPS as mandatory rather than merely presenting it as an example.

T08 · Insecure Dependencies

Note

• Location: package.json:5

Finding

Mutable dependency resolution prevents reproducible installation

Content

View full analysis

Vulnerability Details

File Location: package.json:5-8; README.md:15-18
Vulnerability Type: Unpinned third-party dependency and missing lockfile
Risk Level: Low

Vulnerable Code

json

"dependencies": {
  "axios": "^1.6.0"
}

Installation instructions resolve dependencies dynamically:

md

2.  Open a terminal in the folder and run:
    ```bash
    npm install
    ```

Technical Analysis

The package declares Axios using the mutable range ^1.6.0, and the audited directory contains no package lockfile. Different installations can therefore resolve different Axios and transitive dependency versions without a corresponding change to this Skill's source.

No evidence was found that Axios is malicious or that this project uses a typosquatted package. The security weakness is that the installed dependency graph is not reproducible and can diverge from the version reviewed during the audit. This increases exposure to a compromised, defective, or unexpectedly incompatible future release.

Attack Path

1. A future package version satisfying ^1.6.0, or one of its resolved transitive dependencies, becomes compromised or contains a security defect.
2. An operator follows the documented npm install procedure without a lockfile.
3. npm resolves and downloads the newer dependency graph.
4. The dependency executes during installation or is loaded by scripts/index.js at runtime.
5. Malicious or vulnerable dependency behavior runs with the privileges and environment available to the Skill process, potentially including access to WPCLAW_STORE_SECRET.

Impact Assessment

The exact impact depends on the behavior of a compromised dependency. Because Axios is loaded in the process that holds the store URL and secret, malicious runtime code could potentially read those environment variables, inspect store responses, or transmit process-accessible data. No such malicious behavior ...[truncated 125 chars]

Remediation

View remediation

Remediation Suggestions

• Generate, review, and commit a package-lock.json file.
• Use npm ci in deployment and automated build environments so the reviewed dependency graph is installed exactly.
• Pin reviewed direct dependency versions or manage upgrades through controlled dependency-update pull requests.
• Run dependency vulnerability and integrity checks in CI.
• Review lockfile changes whenever dependencies are updated.
• Use a trusted npm registry and apply organizational registry controls where available.
• Run the Skill under a minimally privileged account and expose only the environment variables required for its operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly advertises access to order status, totals, customer info, and line items, but provides no guidance on handling privacy-sensitive or regulated customer data. In a skill intended for AI agents, that omission increases the risk of accidental over-collection, unnecessary exposure in logs/prompts, or disclosure to unauthorized users through downstream agent behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill requires sensitive environment variables, including a store secret, but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill's access to secrets less transparent to reviewers and enforcement systems, increasing the risk of unintended secret exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The helper performs an HTTP POST to the configured store endpoint, and the exported tools pass user-supplied order IDs and search queries to that remote service. While comments describe functionality, there is no user-facing notice, confirmation, or warning that user requests and store-related data are transmitted over the network.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a caret range ("^1.6.0") rather than being pinned to an exact version, which makes builds non-reproducible and can silently introduce vulnerable or incompatible releases over time. In a connector skill that makes outbound HTTP requests to a WooCommerce store, dependency drift increases supply-chain risk because future installs may pull a different axios version than what was tested.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "OpenClaw skill for WooCommerce integration",
  "main": "index.js",
  "dependencies": {
    "axios": "^1.6.0"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest uses an unpinned axios dependency while the package family has multiple known advisories, so there is no assurance that installations will avoid affected versions. Because this skill is a network connector to a WooCommerce store, an unsafe axios release could increase exposure to issues such as SSRF, request manipulation, credential leakage, or man-in-the-middle-related abuse depending on how the library is used elsewhere in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The code reads WPCLAW_STORE_SECRET from the environment to authenticate requests, but this file provides no user-facing notice that the skill depends on and accesses sensitive credentials. The existing configuration error is developer-oriented and does not serve as a safety disclosure to users.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/index.js:5