Ecomm Ai Voice Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:16 AM UTC
• Version: 1.2.2

Overview

This skill matches its eCommerce automation purpose, but it exposes unauthenticated workflows that can send messages/calls and change order records using the operator's credentials.

Review before installing. Only deploy these workflows behind authenticated, signed, and rate-limited webhooks; remove request-controlled confirmation URLs; validate order IDs, phone numbers, statuses, and state transitions server-side; and use least-privilege provider credentials. Also document customer consent, privacy notices, transcript retention, spreadsheet access, and telecom rules before enabling outbound calls or messages.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: workflows/01-new-order-webhook.json:5
• Finding: Unauthenticated Webhooks Trigger Privileged and Billable Operations<![CDATA[ ## Vulnerability Details **File Location**: `workflows/01-new-order-webhook.json:5-18` **Additional Affected Locations**: `workflows/02-cod-confirmation-call.json:5-18`, `workflows/03-prepaid-confirmation.json:5-18`, `workflows/04-call-result-handler.json:5-18`, `workflows/06-whatsapp-sms-fallback.json:5-18`, `workflows/07-returns-faq-handler.json:5-18`, `workflows/08-order-status-updater.json:5-18`, `workflows/09-crm-sheet-logger.json:5-18`, `workflows/12-customer-callback.json:5-18` **Vulnerability Type**: Missing authentication and request-signature validation **Risk Level**: High ### Vulnerable Code ```json { "parameters": { "httpMethod": "POST", "path": "ecomm-ai/new-order", "responseMode": "responseNode", "options": {} }, "name": "New Order Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2, "webhookId": "ecomm-new-order" } ``` Equivalent unauthenticated webhook definitions are used throughout the listed workflows. No authentication setting, signature-verification node, shared secret, replay protection, or caller authorization check is present. ### Technical Analysis These public webhook endpoints are trust boundaries. They accept caller-controlled input and then execute workflows using credentials owned by the n8n operator, including Vapi, Twilio, WhatsApp, Shopify, WooCommerce, Google Sheets, HubSpot, OpenAI, and SMTP credentials. Knowing or discovering an endpoint path is sufficient to submit a request. The predictable `ecomm-ai/*` paths further reduce the effort needed to identify the endpoints. Authentication is absent both from externally consumed webhooks and from the internal workflow-to-workflow webhook calls. Input validation does not replace authentication. Even workflows that check whether a phone number is present do not establish that the caller is an authorized commerce platform or that the submitted order is genuine. ### Attack Path 1. An attacker identifies the public n8n base URL ...[truncated 1421 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enable n8n webhook authentication for every externally reachable endpoint. 2. Verify provider-specific signatures against the raw request body: - Shopify HMAC headers. - WooCommerce webhook signatures. - Vapi callback signatures or an equivalent shared-secret mechanism. - Twilio request signatures for Twilio-originated callbacks. 3. Use separate internal endpoints for workflow-to-workflow communication and protect them with a randomly generated secret or authenticated n8n sub-workflow execution. 4. Reject requests with missing, invalid, or expired timestamps and store event identifiers to prevent replay. 5. Apply endpoint-specific schemas, strict field limits, phone-number validation, and payload-size limits. 6. Add per-source rate limiting and anomaly alerts for call and messaging volume. 7. Restrict network access to internal-only webhooks where possible. 8. Use separate, least-privilege credentials for each workflow rather than broadly shared integration credentials. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: workflows/08-order-status-updater.json:5
• Finding: Unauthenticated Arbitrary Commerce Order Status Modification<![CDATA[ ## Vulnerability Details **File Location**: `workflows/08-order-status-updater.json:5-142` **Vulnerability Type**: Missing authorization on a privileged order-management endpoint **Risk Level**: Critical ### Vulnerable Code ```json { "parameters": { "httpMethod": "POST", "path": "ecomm-ai/update-order-status", "responseMode": "responseNode", "options": {} }, "name": "Update Status Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2 } ``` ```javascript // Parse status update request const body = $input.first().json.body || $input.first().json; const update = { order_id: body.order_id || '', status: body.status || 'confirmed', platform: (body.platform || 'auto').toLowerCase(), timestamp: new Date().toISOString() }; const shopifyStatusMap = { 'confirmed': 'confirmed', 'cancelled': 'cancelled', 'shipped': 'fulfilled', 'delivered': 'fulfilled' }; const wooStatusMap = { 'confirmed': 'processing', 'cancelled': 'cancelled', 'shipped': 'completed', 'delivered': 'completed' }; update.shopify_status = shopifyStatusMap[update.status] || update.status; update.woo_status = wooStatusMap[update.status] || update.status; return [{ json: update }]; ``` ```json { "method": "PUT", "url": "={{$env.SHOPIFY_STORE_URL}}/admin/api/2024-01/orders/{{$json.order_id}}.json", "sendBody": true, "specifyBody": "json", "jsonBody": "={{ JSON.stringify({ order: { id: $json.order_id, tags: 'ai-confirmed,status:' + $json.status } }) }}", "sendHeaders": true, "headerParameters": { "parameters": [ { "name": "X-Shopify-Access-Token", "value": "{{$env.SHOPIFY_ACCESS_TOKEN}}" } ] } } ``` ```json { "method": "PUT", "url": "={{$env.WOOCOMMERCE_STORE_URL}}/wp-json/wc/v3/orders/{{$json.order_id}}", "sendBody": true, "specifyBody": "json", "jsonBody": "={{ JSON.stringify({ status: $json.woo_status }) }}", "sendHeaders": true, "headerParameters": { "parameters": [ ...[truncated 2478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove public access to this webhook and expose it only through authenticated internal workflow execution. 2. Require a signed request containing the order ID, intended transition, timestamp, nonce, and originating event ID. 3. Allowlist platforms and statuses. Reject every value not explicitly supported. 4. Implement a state-transition policy, such as permitting `new` to become `confirmed` but preventing arbitrary transitions from `delivered` to `cancelled`. 5. Load the order from a trusted data source and confirm that it is bound to the authenticated originating event. 6. Validate order identifiers with platform-specific formats and reject empty identifiers. 7. Make requests idempotent using a unique event or call identifier. 8. Limit commerce credentials to only the permissions necessary for the intended update. 9. Record the authenticated caller, previous state, requested state, and provider response in an immutable audit log. 10. Alert on unusual cancellation, completion, or fulfillment rates. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: workflows/04-call-result-handler.json:5
• Finding: Forged Vapi Callback Can Confirm or Cancel Arbitrary Orders<![CDATA[ ## Vulnerability Details **File Location**: `workflows/04-call-result-handler.json:5-56` **Related Privileged Actions**: `workflows/04-call-result-handler.json:194-318` **Vulnerability Type**: Unverified callback data used to authorize order-state transitions **Risk Level**: Critical ### Vulnerable Code ```json { "parameters": { "httpMethod": "POST", "path": "ecomm-ai/call-result", "responseMode": "responseNode", "options": {} }, "name": "Vapi Callback", "type": "n8n-nodes-base.webhook", "typeVersion": 2 } ``` ```javascript // Parse Vapi end-of-call callback const body = $input.first().json.body || $input.first().json; const result = { call_id: body.call_id || body.id || '', order_id: body.metadata?.order_id || body.assistant_overrides?.metadata?.order_id || '', order_number: body.metadata?.order_number || '', call_type: body.metadata?.type || 'unknown', status: (body.status || body.ended_reason || 'unknown').toLowerCase(), duration: body.duration || body.call_duration || 0, transcript: body.transcript || '', summary: body.summary || body.analysis?.summary || '', customer_phone: body.customer?.number || body.from || '', customer_name: body.customer?.name || '', recording_url: body.recording_url || '', outcome: 'unknown', timestamp: new Date().toISOString() }; const statusMap = { 'completed': 'answered', 'ended': 'answered', 'no-answer': 'no_answer', 'busy': 'no_answer', 'failed': 'failed', 'canceled': 'failed', 'voicemail': 'voicemail' }; result.outcome = statusMap[result.status] || 'unknown'; // Check tool calls for confirm/decline if (body.tool_calls || body.analysis?.tool_calls) { const tools = body.tool_calls || body.analysis.tool_calls || []; for (const tc of tools) { const fn = tc.function?.name || tc.name || ''; if (fn.includes('confirm')) result.outcome = 'confirmed'; else if (fn.includes('decline')) result.outcome = 'declined'; else if (fn.include ...[truncated 2824 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate Vapi's callback signature or use a cryptographically strong shared secret if signature support is unavailable. 2. Obtain and validate the raw request body before parsing or normalizing it. 3. Retrieve the call independently from Vapi using `call_id` before accepting a consequential outcome. 4. Store the call ID, order ID, recipient, call type, and expected assistant when initiating the call. 5. Require the callback to match that stored record exactly. 6. Accept only exact tool names such as `confirm_order`, `decline_order`, and `modify_order`; do not use substring matching. 7. Enforce a server-side transition policy instead of treating a model tool call as authorization. 8. Add idempotency controls keyed by the provider event ID or call ID. 9. Reject callbacks with missing order IDs, unknown calls, unexpected assistants, or inconsistent metadata. 10. Require human review for ambiguous or high-value cancellations. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: workflows/06-whatsapp-sms-fallback.json:5
• Finding: Attacker-Controlled Phishing Links Sent Through Trusted WhatsApp and SMS Accounts<![CDATA[ ## Vulnerability Details **File Location**: `workflows/06-whatsapp-sms-fallback.json:5-121` **Vulnerability Type**: Unvalidated URL injection into outbound customer communications **Risk Level**: High ### Vulnerable Code ```json { "parameters": { "httpMethod": "POST", "path": "ecomm-ai/whatsapp-sms-fallback", "responseMode": "responseNode", "options": {} }, "name": "Fallback Webhook", "type": "n8n-nodes-base.webhook", "typeVersion": 2 } ``` ```javascript // Build WhatsApp and SMS messages const data = $input.first().json.body || $input.first().json; const confirmLink = (data.confirm_url || $env.ECOMM_CONFIRM_BASE_URL || 'https://store.example.com/confirm') + '?order=' + data.order_id; const waMessage = `Hi ${data.customer_name}! 👋\n\n` + `We tried to reach you about your order #${data.order_id}.\n\n` + `Please confirm your order here:\n${confirmLink}\n\n` + `Or reply YES to confirm, NO to cancel.`; const smsMessage = `Hi ${data.customer_name}, we tried calling about order #${data.order_id}. ` + `Please confirm: ${confirmLink} or reply YES/NO.`; return [{ json: { ...data, wa_message: waMessage, sms_message: smsMessage, confirm_link: confirmLink } }]; ``` ```json { "method": "POST", "url": "={{$env.WHATSAPP_API_URL}}", "sendBody": true, "specifyBody": "json", "jsonBody": "={{ JSON.stringify({ messaging_product: 'whatsapp', to: $json.customer_phone, type: 'text', text: { body: $json.wa_message } }) }}", "sendHeaders": true, "headerParameters": { "parameters": [ { "name": "Authorization", "value": "Bearer {{$env.WHATSAPP_API_TOKEN}}" } ] } } ``` ```json { "method": "POST", "url": "={{$env.TWILIO_API_URL}}/2010-04-01/Accounts/{{$env.TWILIO_ACCOUNT_SID}}/Messages.json", "sendBody": true, "specifyBody": "json", "jsonBody": "={{ JSON.stringify({ From: $env.TWILIO_PHONE_NUMBER, To: $json.customer_phone, Body: $json.sms_messag ...[truncated 2165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `data.confirm_url` as an accepted request field. 2. Construct all confirmation links from a fixed, operator-controlled HTTPS origin. 3. If multiple domains are necessary, parse URLs with a proper URL parser and require an exact hostname and scheme allowlist. 4. URL-encode the order identifier rather than concatenating raw input. 5. Use a short-lived, signed confirmation token rather than exposing a bare order ID. 6. Authenticate the webhook and restrict it to internal workflow callers. 7. Verify that the target phone number belongs to the referenced order in a trusted data store. 8. Apply per-order and per-recipient rate limits. 9. Log the final destination hostname and alert on any unexpected value. 10. Prevent automatic SMS fallback for requests that have not passed all authorization and destination-validation checks. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: workflows/02-cod-confirmation-call.json:21
• Finding: Untrusted Order Data Is Interpolated into an AI System Prompt<![CDATA[ ## Vulnerability Details **File Location**: `workflows/02-cod-confirmation-call.json:21-35` **Untrusted Data Origin**: `workflows/01-new-order-webhook.json:21-51` **Vulnerability Type**: Indirect prompt injection through order fields **Risk Level**: Medium ### Vulnerable Code The intake workflow accepts item names and related fields directly from the webhook: ```javascript const body = $input.first().json.body || $input.first().json; const order = { order_id: body.order_id || body.id || body.order_number || '', order_number: body.order_number || body.name || body.id || '', customer_name: body.customer?.first_name ? `${body.customer.first_name} ${body.customer.last_name || ''}`.trim() : (body.billing?.first_name ? `${body.billing.first_name} ${body.billing.last_name || ''}`.trim() : body.customer_name || ''), customer_phone: body.customer?.phone || body.billing?.phone || body.shipping_address?.phone || body.phone || '', total_amount: parseFloat( body.total_price || body.total || body.order_total || 0 ), currency: body.currency || 'USD', items: (body.line_items || body.items || []).map(i => ({ name: i.name || i.title, quantity: i.quantity || 1, price: i.price || i.total })) }; order.items_summary = order.items.map(i => `${i.quantity}x ${i.name}`).join(', '); ``` The downstream call workflow places those values inside a system-role message: ```javascript const script = `Hello ${order.customer_name}, this is a confirmation call for your order #${order.order_number}. ` + `You ordered ${order.items_summary} for a total of ${order.currency} ${order.total_amount}. ` + `This is a Cash on Delivery order. Can you please confirm you would like to proceed with this order?`; return [{ json: { ...order, call_script: script, vapi_payload: { assistantId: '{{$env.VAPI_COD_ASSISTANT_ID}}', customer: { number: order.customer_phone, name: order.cust ...[truncated 2929 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate untrusted order data into system-role instructions. 2. Keep the fixed policy in the system message and provide order data through a structured tool result or separate user message. 3. Clearly delimit all untrusted fields and explicitly state that content inside the data block is data, not instructions. 4. Normalize and length-limit customer names, order numbers, item names, and currency values. 5. Reject control characters and suspicious instruction-like content where compatible with business requirements. 6. Define a strict tool schema and validate every tool argument server-side. 7. Never treat a model tool call alone as authorization for an order-state change. 8. Correlate tool calls with authenticated calls and require deterministic business validation before confirmation or cancellation. 9. Consider human review for high-value, ambiguous, or conflicting outcomes. 10. Test the assistant against prompt-injection payloads in all customer-controlled commerce fields. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The workflow sends customer phone number, name, order details, and order metadata to an external Vapi endpoint to place an outbound call. In this file there is no warning, confirmation, or disclosure comment indicating that personal/order data will be shared with a third-party service.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: This node sends customer phone, name, email, order, and platform metadata to HubSpot, but the file gives no indication that operators or end users are warned that a third-party SaaS will receive the data. In combination with the unauthenticated webhook, this increases the risk of unauthorized PII export and unexpected cross-system propagation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes workflows that collect and transmit customer phone numbers, emails, order details, call transcripts, and CRM data across Vapi, Twilio, Google Sheets, HubSpot, Shopify/WooCommerce, and WhatsApp, but it does not warn users about privacy, consent, data retention, or jurisdictional compliance obligations. In this context, the omission is security-relevant because operators may deploy the system without understanding that sensitive customer data is being shared with multiple third parties and logged in broadly accessible systems like spreadsheets.

External Transmission

Medium

• Category: Data Exfiltration

Content

TWILIO_ACCOUNT_SID=your-sid
TWILIO_PHONE_NUMBER=[phone]
TWILIO_AUTH_HEADER=Basic base64encoded
TWILIO_API_URL=https://api.twilio.com/2010-04-01

# Inter-workflow routing
N8N_WEBHOOK_BASE=https://your-n8n-instance.com/webhook

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The workflow exposes a publicly reachable POST webhook at a predictable path and does not perform any authentication, signature verification, IP allowlisting, or other invocation constraints before processing order data. In this eCommerce context, an attacker could submit forged orders, pollute Google Sheets with attacker-controlled PII/content, and trigger downstream COD/prepaid confirmation workflows, making the lack of request validation materially risky.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The workflow exposes a POST webhook at a predictable path and the file shows no authentication, signature verification, shared secret, IP allowlist, or payload validation before triggering an outbound customer call. An attacker who can reach the endpoint could submit arbitrary order/customer data, causing unauthorized calls, spam, and pollution of downstream order logs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow appends customer phone number, customer name, order identifiers, and call metadata to a Google Sheet. This persists personal data, but the file contains no warning, notice, or explanatory comment about that storage behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow updates the Orders sheet to mark the order status as "call_initiated" and stores call metadata. This is a persistent state change affecting business records, but the file provides no user-facing warning or explanatory comment about the update.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The SMS template is hard-coded in English, and the workflow contains no indication that language is selected based on user preference or limited to an English-only context. This is a natural-language policy issue because it imposes a specific language on end users without opt-in or justification.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The outbound call's firstMessage is explicitly written in English and there is no evidence in the workflow that customers can choose another language or that the workflow is restricted to an English-speaking audience. This violates the language/locale policy criteria for natural-language content.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This workflow exposes a POST webhook that appears to accept end-of-call callbacks and then directly updates Google Sheets records, retry queues, and downstream order-status workflows based entirely on request body fields. There is no visible authentication, signature verification, shared secret validation, or source allowlisting, so an attacker who can reach the endpoint could forge callbacks to mark orders confirmed/declined, enqueue retries, or trigger SMS fallback actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This workflow automatically sends customer_phone, customer_name, and order metadata to external endpoints via the WhatsApp/SMS fallback and Vapi call nodes. The file contains no user-facing warning, confirmation step, or explanatory comment/docstring disclosing that personal data is transmitted to third-party services.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The workflow exposes a POST webhook that can trigger outbound WhatsApp/SMS sending using attacker-supplied order_id, customer_name, and customer_phone, but there is no visible authentication, signature verification, allowlist, or other trigger constraint. In this context, that creates a message-relay/abuse endpoint that could be used to spam arbitrary numbers, generate telecom/API charges, and poison the call log with fraudulent entries.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The generated WhatsApp and SMS messages force English-language communication to end users. Under the policy, locale or language must not be forced without user opt-in or a clearly documented, justified region-specific constraint.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The workflow tells users it will check refund status, but the node returns a hard-coded status message without querying any order, refund, or payment system. This can mislead customers into believing sensitive account-specific actions were performed, causing incorrect support outcomes and potentially masking operational failures.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The workflow claims it will look up order or shipping status, but it only generates a canned response and performs no retrieval from Shopify, WooCommerce, carrier APIs, or internal systems. In a customer-support context, this creates deceptive behavior that can misinform customers and delay resolution of real order issues.

External Transmission

Medium

• Category: Data Exfiltration

Content

{
      "parameters": {
        "method": "POST",
        "url": "https://api.openai.com/v1/chat/completions",
        "sendBody": true,
        "specifyBody": "json",
        "jsonBody": "={{ JSON.stringify({\n  model: 'gpt-4o-mini',\n  messages: [\n    { role: 'system', content: 'You are an eCommerce customer support assistant. Answer the customer\\'s question helpfully and concisely. If you cannot answer, say you will connect them to a human agent.' },\n    { role: 'user', content: $json.message || 'General inquiry about order #' + $json.order_id }\n  ],\n  max_tokens: 300\n}) }}",

• Confidence: 84% confidence
• Finding: This workflow transmits externally supplied customer inquiry content to a third-party API endpoint at OpenAI. While external API use is common, in this context it is security-relevant because potentially sensitive support data leaves the primary environment and is processed by another service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Customer inquiry text, which may contain personal or order-related information, is sent to OpenAI for FAQ generation with no evidence in this file of notice, consent, minimization, or filtering. This creates privacy and compliance risk because externally processing customer support content may violate policy, customer expectations, or applicable data-handling requirements.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The workflow sends customer phone numbers and message content to Twilio without any visible disclosure or consent handling in the workflow. In an eCommerce support setting, this can create privacy and telecom-compliance issues, especially if users did not explicitly agree to receive SMS messages or if sensitive order details are included.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The workflow appends customer order identifiers, phone numbers, response summaries, and timestamps to Google Sheets without any visible notice, retention policy, or access-control safeguards in this file. Storing support interactions in a spreadsheet increases the risk of overexposure, mishandling, and unauthorized access to customer data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This workflow performs external HTTP PUT requests that modify live order records in Shopify and WooCommerce, but the file contains no visible confirmation step, no user-facing disclosure, and no descriptive warning comment around these operations. Because this is a manifest/config file rather than a README or markdown description, there is no accompanying in-file warning that the webhook can change production order state.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The workflow reads environment-based credentials such as SHOPIFY_ACCESS_TOKEN and WOOCOMMERCE_AUTH_HEADER and sends them in HTTP headers, but there is no warning, comment, or user-facing notice explaining that sensitive credentials are used for outbound authenticated requests. This qualifies as credential access/network transmission lacking disclosure under the rule.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The auto-detect branch claims to determine the target platform, but it only relabels the payload and then proceeds directly to logging and responding without performing any Shopify or WooCommerce update. In an order-management workflow, this creates a silent integrity failure where callers receive a success response even though no external order status was changed, which can mislead operators and downstream automations.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The code comment and workflow behavior imply that auto-detection will support updating unknown-platform orders, but the implementation only sets a platform field and skips the actual update request. This discrepancy is dangerous because it can cause false assurance, audit inaccuracies, and inconsistent order states while returning an 'ok' response to the caller.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The webhook accepts POST requests on a generic path without any visible authentication, signature verification, IP allowlisting, or request validation. An attacker who discovers the endpoint could submit arbitrary records, pollute CRM data, trigger external syncs, and exfiltrate or poison downstream business systems.

Static analysis

No suspicious patterns detected.