Creem Store Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

This skill is clearly intended to monitor a Creem store, but it can automatically make live billing and subscription changes with weak authorization and validation controls.

Review this carefully before installing, especially on a production Creem account. Use test-mode credentials first, disable or remove automatic execution unless you have a strong approval policy, restrict the Creem API key, limit Telegram operators, and add validation for LLM outputs and webhook body sizes before relying on it for live billing workflows.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: src/llm-analyzer.ts:31

Finding

Webhook-Derived Text Can Manipulate Autonomous Financial Decisions Through Prompt Injection

Content

View full analysis

$500 total or >6 months): prefer CREATE_DISCOUNT with 20-40% - Low-tenure (<2 months) or low-value: prefer NO_ACTION - Medium cases: consider SUGGEST_PAUSE - Include confidence (0-1) in your assessment Respond in JSON only: {"action": "CREATE_DISCOUNT|SUGGEST_PAUSE|NO_ACTION", "reason": "one sentence", "confidence": 0.0-1.0, "params": {...}}`; } ``` `src/index.ts:61-66` treats model confidence as authorization for execution: ```ts // Auto-execute if confidence is high enough if (shouldAutoExecute(decision, AUTO_EXECUTE_THRESHOLD)) { const result = await executeAction(decision, churnCtx, creem as any); const resultMsg = formatActionResult(result, churnCtx); await bot.sendMessage(`🤖 Auto-executed (confidence ${Math.round(decision.confidence * 100)} ...[truncated 2345 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/action-executor.ts:26

Finding

Unvalidated LLM Parameters Are Passed Directly to the Creem Discount API

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.ts:69

Finding

Telegram Callbacks and Commands Do Not Verify the Authorized Chat or User

Content

View full analysis

): Promise; on(event: string, handler: (...args: unknown[]) => void): void; onText(pattern: RegExp, handler: (msg: { chat: { id: number } }) => void): void; } export function createTelegramBot(rawBot: RawTelegramBot, chatId: string): TelegramBot { return { async sendMessage(text, options) { await rawBot.sendMessage(chatId, text, options); }, onCallbackQuery(handler) { rawBot.on("callback_query", handler as (...args: unknown[]) => void); }, onText(pattern, handler) { rawBot.onText(pattern, handler); }, }; } ``` `src/index.ts:69-101` executes actions based only on callback data and a matching pending subscription: ```ts async function handleTelegramAction(data: string): Promise { const [action, subscriptionId] = data.split(":"); if (!action || !subscriptionId) return; if (action === "skip") { pendingDecisions.delete(subscriptionId); await bot.sendMessage(`⏭️ Skipped action for ${subscriptionId}`); return; } if (action === "apply" || action === "pause") { const entry = pendingDecisions.get(subscriptionId); if (!entry) { await bot.sendMessage(`❌ No pending decision for ${subscriptionId}`); return; } const overrideDecision = action === "apply" ? entry.decision : { ...entry.decision, action: "SUGGEST_PAUSE" as const }; const result = await executeAction(overrideDecision, entry.context, creem as any); const resultMsg = formatActionResult(result, entry.con ...[truncated 2305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/webhook-handler.ts:13

Finding

Unbounded Webhook Body Buffering and Deduplication Storage Allow Memory Exhaustion

Content

View full analysis

{ const chunks: Buffer[] = []; for await (const chunk of req) { chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk); } return Buffer.concat(chunks).toString("utf-8"); } ``` `src/webhook-handler.ts:36-64` reads the body before checking the signature and stores unique event IDs indefinitely: ```ts export function createWebhookHandler(config: WebhookHandlerConfig): (req: IncomingMessage, res: ServerResponse) => Promise { const { secret, onEvent } = config; const processedEvents = new Set(); return async (req: IncomingMessage, res: ServerResponse): Promise => { const body = await readBody(req); const signature = (req.headers["creem-signature"] as string) ?? ""; if (!signature) { return jsonResponse(res, 401, { error: "Missing signature" }); } if (!verifySignature(body, signature, secret)) { return jsonResponse(res, 401, { error: "Invalid signature" }); } let payload: CreemWebhookPayload; try { payload = JSON.parse(body); } catch { return jsonResponse(res, 400, { error: "Invalid JSON" }); } if (payload.id && processedEvents.has(payload.id)) { return jsonResponse(res, 200, { status: "ok", deduplicated: true }); } if (payload.id) { processedEvents.add(payload.id); } ``` ### Technical Analysis The handler stores every incoming chunk and concatenates the complete body before checking whether a signature is present or valid. Consequently, an unauthenticated request can force large memory allocations before receivi ...[truncated 1658 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (87)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more security-significant because it references state-changing actions such as creating discounts and pausing subscriptions while the public description frames the skill mainly as monitoring and recommendations. Undisclosed write actions against billing/subscription systems can surprise operators and, if triggered improperly, cause financial loss or customer-impacting changes.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · demo/demo-script.ts (reported line 4)May include surrounding context.

ts

import { readFileSync } from "node:fs";
import { createServer } from "node:http";

// Load .env (no dotenv dependency needed)
try {
  const env = readFileSync(new URL("../.env", import.meta.url), "utf-8");
  for (const line of env.split("\n")) {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · demo/server.ts (reported line 4)May include surrounding context.

ts

import { readFileSync } from "node:fs";
import { createServer } from "node:http";

// Load .env (no dotenv dependency needed)
try {
  const env = readFileSync(new URL("../.env", import.meta.url), "utf-8");
  for (const line of env.split("\n")) {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · demo/demo-script.ts (reported line 6)May include surrounding context.

ts

// Load .env (no dotenv dependency needed)
try {
  const env = readFileSync(new URL("../.env", import.meta.url), "utf-8");
  for (const line of env.split("\n")) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith("#")) continue;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · demo/server.ts (reported line 6)May include surrounding context.

ts

// Load .env (no dotenv dependency needed)
try {
  const env = readFileSync(new URL("../.env", import.meta.url), "utf-8");
  for (const line of env.split("\n")) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith("#")) continue;

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

form-data 4.0.5 is present as a transitive dependency of @cypress/request and is flagged for CRLF injection in multipart field names. In a lockfile this is a real supply-chain risk because if application code or a dependency builds multipart requests from attacker-controlled field names, it can corrupt request bodies or headers; however, exploitability depends on actual runtime usage and untrusted input reachability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.4 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

brace-expansion 5.0.4 is a real vulnerable package with multiple algorithmic complexity and memory exhaustion advisories. In this lockfile it is a transitive dev/build dependency, so exploitation would usually require feeding attacker-controlled glob/brace patterns into tooling rather than exploiting the deployed skill directly.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

fast-uri 3.1.0 is present and the advisories include SSRF and host confusion issues, making this a substantive vulnerable dependency. Because this skill monitors a store and may interact with remote APIs or webhooks, any unsafe URI parsing in reachable server or client code could increase the chance of request misrouting or SSRF-like behavior if attacker-controlled URLs are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==2.5.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

form-data 2.5.5 is another real instance of the same CRLF injection issue, but this copy is marked dev-only through @types/request-related tooling and is less likely to affect production behavior. The vulnerable package still increases supply-chain exposure in development and CI if multipart fields can be influenced by untrusted input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

brace-expansion 2.0.2 is also a true vulnerable dependency with DoS-style expansion issues. As with the other brace-expansion finding, its placement under dev tooling makes it unlikely to be exploitable through normal skill operation, though it can still affect CI or local developer workflows that process attacker-supplied patterns.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.8 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

hono 4.12.8 is a real vulnerable dependency with numerous advisories, including cookie handling and routing issues. This is more relevant than many dev-only findings because it is pulled by the MCP SDK, and the skill description suggests a networked agent that may expose server endpoints or callbacks, so flawed HTTP handling could be reachable in practice.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

ip-address 10.1.0 is a real vulnerable dependency, with findings around ambiguous IPv4 parsing and XSS in HTML-emitting methods. In this skill context, impact is limited unless the library is used for security decisions on IP allow/deny logic or its HTML output is rendered somewhere; the lockfile alone does not show such usage.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The action name "SUGGEST_PAUSE" implies a non-destructive recommendation, but the implementation directly calls creem.subscriptions.pause(...) and changes the customer’s subscription state. This mismatch is dangerous because an LLM, operator, or downstream workflow may treat the action as advisory while it actually performs a real account modification, increasing the chance of unintended service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes autonomous execution of billing-impacting actions such as creating discounts and pausing subscriptions, but it does not prominently warn that these actions can modify live customer accounts and revenue state. In an agent skill context, normalizing unsupervised financial/account changes increases the chance of accidental or overbroad execution, especially if operators enable it in production without understanding the consequences.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

Advertising 'Auto-execute' based solely on an AI confidence threshold means the system may take real business actions without human verification. In this skill, those actions affect discounts and subscription lifecycle, so LLM misclassification, prompt/input anomalies, or incomplete customer context could directly alter revenue and customer access.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

md

### Autonomous Actions

- **Auto-execute** when AI confidence ≥ 80%
- **Manual approval** via Telegram inline buttons when confidence is lower
- Actions: Apply retention discount, pause subscription, or skip

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The workflow description confirms that high-confidence AI decisions auto-execute and then call Creem SDK methods to create discounts or pause subscriptions. This is dangerous because the README presents autonomous operational control over customer billing state as a standard behavior, increasing the risk of unintended account changes if the model is wrong or inputs are manipulated.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

3. **Deduplication** — event IDs tracked in memory to prevent duplicate processing
4. **Classification** — cancellations go through AI analysis; everything else gets a formatted alert
5. **AI Analysis** — Claude Haiku evaluates customer value, tenure, and cancel reason
6. **Action** — high-confidence decisions auto-execute; others await Telegram approval
7. **Execution** — creates retention discounts or pauses subscriptions via Creem SDK

### LLM Decision Logic

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares required environment variables and clearly implies networked behavior (webhooks, Telegram, external AI API), but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective capabilities less transparent to reviewers and users, increasing the risk of over-privileged execution or unexpected external communication.

Content

No source excerpt is available for this finding.