ClawHub
Back to skill

Security audit

ecommerce-expert

Security checks for vulnerabilities and agentic risk

Overview

This skill is an e-commerce coding guide, but its production-looking examples include unsafe payment and account-handling patterns that users should review before relying on them.

Install only if you want general e-commerce reference material and will treat the large code example as illustrative, not production-ready. Before using any payment, refund, fulfillment, or account code, require sandbox credentials, real provider verification, webhook validation, least-privilege service credentials, privacy review for customer/order data, and response DTOs that never expose password hashes or tokens.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
references/examples.md:798
Finding

PayPal and Klarna Payment Stubs Unconditionally Approve Transactions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/examples.md:1307
Finding

Authentication Services Return Customer Records Containing Password Hashes

Content
View full analysis
{ const customer = await prisma.customer.findUnique({ where: { email }, }); if (!customer) { throw new Error('Invalid credentials'); } const validPassword = await bcrypt.compare(password, customer.password); if (!validPassword) { throw new Error('Invalid credentials'); } if (!customer.verified) { throw new Error('Please verify your email'); } // Generate JWT token const token = jwt.sign( { customerId: customer.id, email: customer.email, }, process.env.JWT_SECRET!, { expiresIn: '7d' } ); // Update last login await prisma.customer.update({ where: { id: customer.id }, data: { lastLogin: new Date() }, }); return { custom ...[truncated 2593 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/examples.md (reported line 1146)May include surrounding context.

md
},
        });
        
        // Send return instructions
        await this.sendReturnInstructions(order, returnRecord);
        
        return returnRecord;

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The example demonstrates creating Stripe payment intents and issuing refunds, which are safety-critical financial actions with potentially irreversible consequences. The markdown surrounding the example does not disclose that these operations can charge customers or return funds if adapted with live credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes code that sends order email addresses, order details, items, and shipping addresses to SQS queues for email and fulfillment processing. Under the markdown-file criteria, the description provides no warning that the example transmits user data to external services, which could affect privacy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.