Security audit

Coupang Shopping Relay

Security checks for vulnerabilities and agentic risk

Overview

This shopping skill has no hidden installer code, but it can automatically change a logged-in Coupang cart and retain shopping details with weaker user controls than expected.

Install only if you are comfortable letting the skill operate a logged-in Coupang browser and modify your cart. For safer use, ask it to preview all selected products, options, quantities, and prices before adding anything, avoid batch auto-add for ambiguous items, review the cart before checkout, and do not persist cart history, screenshots, addresses, payment details, or sensitive shopping preferences unless you explicitly want that saved.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill’s safety section says options should not be chosen arbitrarily, but batch mode later permits automatic option selection without user confirmation. In an e-commerce context, option choices can materially change product type, size, price, or perishability, so this can cause unauthorized purchases or the wrong item being added to a logged-in user’s cart.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The log explicitly introduces a batch mode that automatically selects and adds multiple products without per-item user approval. In a shopping automation skill operating against a logged-in real user session, this expands from assistive browsing into autonomous state-changing behavior, creating a real risk of unauthorized cart manipulation and unintended purchases downstream.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file documents a safer operating rule requiring user approval before adding a candidate, then later removes that safeguard for batch mode. This contradiction is dangerous because it normalizes bypassing human approval precisely for actions that modify the user's cart, increasing the chance of unwanted or incorrect purchases.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guidance explicitly switches into a batch mode that auto-selects products and adds them to the cart across multiple requested items, while stating that intermediate reporting is forbidden and the user should not be consulted mid-process. For a logged-in shopping relay with write access to a real cart, this expands the skill from assisted browsing into autonomous transactional behavior, increasing the risk of unauthorized purchases, unwanted substitutions, and silent cart manipulation.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The document instructs operators to accumulate user-specific shopping preferences and records current cart contents beyond a transient session need. Even though some highly sensitive fields are excluded, retained preference profiles and cart history can still expose health, lifestyle, household, or behavioral information and create unnecessary long-term data collection.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The file recommends persisting operational memory in user notes, repository files, or conversation summaries, creating durable storage outside the immediate shopping session. This broadens the skill into a retention mechanism that may preserve shopping behavior, inferred preferences, and cart-related data in locations with weaker access controls, longer retention, or accidental sharing risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Batch mode is designed to parse multiple requested items and add them to the cart without intermediate confirmation or visible warning that product selection will be automatic. Because this skill operates in a logged-in shopping session, silent automatic cart modification increases the chance of unintended purchases, especially when search ambiguity, ads, substitutions, or product variants are involved.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Allowing automatic option selection without a clear warning is risky because product options often determine critical purchase attributes such as weight, count, flavor, size, or subscription-like variations. In a live logged-in retail session, this can lead to materially different items being added than the user intended, with financial and trust impacts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The batch-mode guidance explicitly allows the agent to add items to a logged-in user's Coupang cart without pausing for per-item user confirmation. Because cart modification is a state-changing action in an authenticated commerce session, this can cause unauthorized or mistaken additions, especially when search parsing, option detection, or product selection is imperfect. The skill context increases risk because it operates in a real consumer account and is designed to perform shopping actions, not just read-only analysis.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document describes automated deletion and add-to-cart flows but does not frame these as sensitive state-changing operations requiring prominent user warning and consent. In a logged-in commerce context, silent cart mutation can affect checkout contents, pricing, subscriptions, or household orders without the user realizing what changed.

Missing User Warnings

High

Confidence: 96% confidence
Finding: This section explicitly permits automatic product selection and add-to-cart without user confirmation, yet presents it as an operational improvement rather than a hazardous mode. Because the skill acts in a logged-in Coupang session, this can directly alter a user's cart at scale and materially increase the chance of unauthorized purchases or manipulation.

Static analysis

No suspicious patterns detected.