T09 · Insecure Skill Coding Practices
Warning
- Location
- assets/ebay-listing-template.md:33
- Finding
- Unverified Seller, Fulfillment, and Authentication Claims in Listing Templates## Vulnerability Details **File Location**: `assets/ebay-listing-template.md:33-43` and `assets/ebay-listing-template.md:110-113`; the template is mandated by `SKILL.md:79-80` **Vulnerability Type**: Unverified fixed claims in generated marketplace content **Risk Level**: Medium ### Vulnerable Code `SKILL.md:79-80`: ```markdown ### eBay listing output Use the bundled template in [assets/ebay-listing-template.md](assets/ebay-listing-template.md) when generating listing copy. ``` `assets/ebay-listing-template.md:33-43`: ```markdown ## Shipping & Handling 🚚 **Same-Day Shipping** (orders by 2 PM EST) 📦 **Premium Packaging**: Team bags, toploaders, bubble mailers 🔒 **Insurance Included** on all orders $100+ 📍 **Tracking Provided** for all shipments ## Seller Credentials ⭐ **99.8% Positive Feedback** ({FEEDBACK_COUNT}+ transactions) 🏆 **Top Rated Seller** with eBay Premium Service 🎯 **Card Specialist** - {YEARS_EXPERIENCE}+ years in the industry 🔍 **Authentication Guarantee** - 30-day return policy ``` `assets/ebay-listing-template.md:110-113`: ```markdown ## Authenticity Guarantee ✅ Examined by vintage card specialist ✅ Period-appropriate printing and materials verified ✅ 30-day authenticity guarantee ✅ Detailed condition photos provided ``` ### Technical Analysis The Skill explicitly directs the agent to use the bundled eBay template, but the template contains fixed assertions about same-day shipping, insurance, tracking, seller status, feedback percentage, professional expertise, return policies, and authentication. Most of these claims are not represented as optional placeholders and do not require verification from the user or a live marketplace integration. An agent following the Skill can therefore reproduce these statements even when the seller never supplied or confirmed them. The issue conflicts with the factual-output requirements in `SKILL.md:84-85` and `SKILL.md:113`, whic ...[truncated 1741 chars]
- Remediation
- ## Remediation Suggestions 1. Replace every fixed seller or fulfillment assertion with an explicit placeholder, including: - `{SHIPPING_CUTOFF}` - `{PACKAGING_METHOD}` - `{INSURANCE_POLICY}` - `{TRACKING_POLICY}` - `{FEEDBACK_PERCENTAGE}` - `{TOP_RATED_STATUS}` - `{SELLER_EXPERIENCE}` - `{RETURN_POLICY}` - `{AUTHENTICATION_BASIS}` 2. Omit each field by default unless the user affirmatively supplies or verifies its value. 3. Add an instruction to `SKILL.md` requiring the agent to distinguish: - User-confirmed facts. - Facts verified through an approved live integration. - Unknown details that must be omitted or marked for verification. 4. Add a pre-output validation step that rejects unsupported claims concerning seller status, guarantees, authentication, fulfillment times, insurance, tracking, and return policies. 5. Replace categorical authentication language with neutral wording unless evidence is available. For example: ```markdown Authentication: {AUTHENTICATION_DETAILS_IF_VERIFIED} ``` 6. Require the generated draft to include a verification checklist for any unresolved marketplace-policy or seller-specific fields. 7. Add template-level comments making clear that placeholders must never be populated with invented defaults.