daily-sales-digest

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:30 PM UTC
• Version: 1.0.0

Overview

This sales-reporting skill is partly coherent, but it has material review concerns around sensitive sales data delivery, unsafe command construction, and mock data being written like real records.

Review carefully before installing. Do not use the provided Discord ID; replace it with a destination you control, keep delivery disabled until tested, protect the config file containing API keys, and avoid running the test or --force collection against real sales data. The Discord delivery code should be fixed to avoid shell interpolation before scheduled use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/digest.js:269
• Finding: Shell Command Injection in Discord Delivery<![CDATA[ ## Vulnerability Details **File Location**: `scripts/digest.js:269-279`; equivalent vulnerable construction at `scripts/alert.js:124-134` **Vulnerability Type**: OS command injection through shell interpolation **Risk Level**: High ### Vulnerable Code ```javascript function deliverDiscord(config, content) { if (!config.delivery.discord.enabled) { console.error('❌ Discord 전송이 비활성화되어 있습니다.'); return; } const channelId = config.delivery.discord.channelId; try { execSync(`openclaw message send --channel discord --target "${channelId}" --message "${content.replace(/"/g, '\\"')}"`, { stdio: 'inherit' }); console.log('✅ Discord 전송 완료'); } catch (err) { console.error('❌ Discord 전송 실패:', err.message); } } ``` The same pattern appears in `scripts/alert.js`: ```javascript execSync(`openclaw message send --channel discord --target "${channelId}" --message "${message.replace(/"/g, '\\"')}"`, { stdio: 'inherit' }); ``` ### Technical Analysis `execSync()` receives a single command string, so Node.js invokes a shell to interpret it. Both `channelId` and message content are interpolated into that string. Escaping only double quotation marks does not prevent shell evaluation. Command substitutions such as `$(command)` and backticks are still evaluated inside double-quoted shell arguments. Backslashes and other shell syntax can also alter parsing. The channel identifier comes from the writable configuration file. In `digest.js`, message content is derived partly from stored sales JSON, including source names. Consequently, either configuration tampering or maliciously crafted report data can reach the shell command. ### Attack Path 1. An attacker obtains write access to the Skill configuration or a sales JSON file. 2. The attacker places shell syntax such as `$(malicious-command)` in `delivery.discord.channelId` or a report field included in the digest. 3. A user or scheduled job runs the digest or alert with Discor ...[truncated 813 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never construct a shell command by concatenating configuration or report data. - Use an argument-array API with shell processing disabled: ```javascript const { execFileSync } = require('child_process'); execFileSync( 'openclaw', [ 'message', 'send', '--channel', 'discord', '--target', channelId, '--message', content ], { stdio: 'inherit', shell: false } ); ``` - Apply the same correction to `scripts/alert.js`. - Validate Discord channel IDs against the expected numeric format, for example `/^\d{17,20}$/`. - Validate the structure and types of loaded sales JSON before formatting it. - Run scheduled jobs under a dedicated, minimally privileged account. - Add regression tests containing `$()`, backticks, quotes, backslashes, newlines, and shell metacharacters. ]]>

other

Error

• Location: config.template.json:37
• Finding: Fixed Personal Discord Destination Can Disclose Sensitive Sales Data<![CDATA[ ## Vulnerability Details **File Location**: `config.template.json:37-40`; also documented in `INSTALLATION.md:52-56,181` and `EXAMPLES.md:242-246` **Vulnerability Type**: Sensitive business-data disclosure to an unintended recipient **Risk Level**: High ### Vulnerable Code ```json "discord": { "enabled": false, "channelId": "YOUR_DISCORD_CHANNEL_ID", "description": "Discord channel ID (형님 DM: 1468204132920725535)" } ``` The installation documentation provides the same concrete destination as configuration: ```json "discord": { "enabled": true, "channelId": "1468204132920725535" } ``` ### Technical Analysis The Skill legitimately needs a user-selected delivery destination. It does not need a fixed personal Discord DM identifier. Repeating a concrete identifier in the template, installation instructions, examples, and troubleshooting guidance makes it likely that users will copy that value without recognizing it as a third-party destination. The delivered reports contain commercially sensitive information, including daily, weekly, and monthly revenue, order counts, average order values, trends, and anomaly notifications. Automatic cron examples can repeatedly transmit these records. This behavior exceeds minimum privilege because only a placeholder and explicit user selection are necessary for the declared delivery feature. ### Attack Path 1. A user follows the installation or troubleshooting documentation. 2. The user copies the supplied Discord channel identifier into the configuration. 3. The user enables Discord delivery and registers one or more scheduled jobs. 4. `digest.js` or `alert.js` sends sales information through OpenClaw messaging. 5. Reports are delivered to the fixed personal DM rather than a destination verified as belonging to the user. ### Impact Assessment The unintended recipient may receive recurring business intelligence, including: - Revenue totals and sales trends. - Order volumes and average transaction va ...[truncated 243 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the concrete Discord identifier from all templates and documentation. - Use only an unmistakable placeholder such as `YOUR_OWN_DISCORD_CHANNEL_ID`. - Require users to confirm the destination before enabling delivery. - Reject known example values and unchanged placeholders at runtime. - Display a redacted destination and require an explicit test message before scheduling reports. - Document that sales reports contain confidential business information. - Review existing installations and remove any scheduled jobs targeting the published identifier. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: test.sh:27
• Finding: Test Script Overwrites Production Sales Data with Random Mock Values<![CDATA[ ## Vulnerability Details **File Location**: `test.sh:27-29` **Vulnerability Type**: Unsafe test isolation and destructive data overwrite **Risk Level**: Medium ### Vulnerable Code ```bash # 3. 데이터 수집 테스트 echo "3️⃣ 데이터 수집 테스트..." node scripts/collect.js --date yesterday --force ``` The invoked collection script writes to the configured production data directory: ```javascript const filePath = path.join(dataDir, `${dateStr}.json`); fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf8'); ``` ### Technical Analysis The installation guide instructs users to execute `./test.sh`. The test then invokes collection for the previous day with `--force`, bypassing the existing-file safety check. Collection currently generates random mock revenue and order values. Because the test uses the normal configuration and normal sales directory instead of a temporary test fixture, it can replace a genuine prior-day sales file with fabricated data. This violates test isolation and data-integrity principles. ### Attack Path 1. A user already has a sales JSON file for the previous day. 2. The user follows the installation instructions and executes `./test.sh`. 3. The test invokes `collect.js --date yesterday --force`. 4. The normal existence check is bypassed. 5. Random mock values are written over the existing file. 6. Subsequent reports and anomaly calculations consume the fabricated data. ### Impact Assessment The issue can cause: - Permanent loss of the overwritten prior-day record unless a backup exists. - Incorrect daily, weekly, and monthly reports. - False anomaly notifications or failure to detect genuine anomalies. - Incorrect operational or financial decisions based on fabricated figures. The overwrite is limited to files writable by the user, but it directly affects the Skill’s primary business dataset. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a temporary directory for every test run: ```bash TEST_DATA_DIR="$(mktemp -d)" trap 'rm -rf "$TEST_DATA_DIR"' EXIT ``` - Pass a dedicated test configuration that points `dataDir` to that directory. - Remove `--force` from tests operating against user-configured storage. - Refuse to run mock collection when the target file already exists. - Add an explicit environment guard such as `NODE_ENV=test`. - Back up existing data before any operation that can overwrite it. - Clearly distinguish mock and production collection modes in filenames and configuration. ]]>

T08 · Insecure Dependencies

Warning

• Location: API_INTEGRATION.md:72
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `API_INTEGRATION.md:72-75,365-372`; equivalent installation guidance at `INSTALLATION.md:150-155` **Vulnerability Type**: Mutable dependency and supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```bash cd /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest npm init -y npm install axios ``` The suggested manifest uses a version range: ```json "dependencies": { "axios": "^1.6.0" } ``` ### Technical Analysis The project does not provide a reviewed package manifest and lockfile. Instead, users are instructed to initialize a package dynamically and install from the npm registry at execution time. `npm install axios` resolves the current registry version and transitive dependency graph. The caret range also allows versions newer than the one represented in the documentation. Without a committed lockfile and integrity metadata, different users or installation dates can receive different code. No evidence shows that `axios` itself is malicious. The vulnerability is the unsafe and mutable dependency acquisition process. ### Attack Path 1. A user follows the API integration instructions. 2. The user runs `npm install axios`. 3. npm resolves package and transitive dependency versions from the registry at that time. 4. Any compromised, unexpectedly changed, or maliciously redirected dependency is installed into the Skill environment. 5. Dependency code executes when imported, and lifecycle scripts may execute during installation unless disabled. ### Impact Assessment A compromised dependency can run with the installing user’s privileges and may access: - Marketplace and POS credentials in the OpenClaw configuration. - Stored sales reports. - Environment variables and user-accessible files. - The network and other local OpenClaw resources. The risk is supply-chain dependent rather than a confirmed active package compromise. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Commit a reviewed `package.json` and lockfile to the project. - Pin dependencies to exact, currently maintained versions rather than broad ranges. - Install reproducibly with `npm ci`. - Use `npm ci --ignore-scripts` where package requirements permit it. - Review transitive dependencies and run appropriate vulnerability and provenance checks. - Record package integrity hashes through the lockfile. - Avoid directing users to run `npm init` and mutable registry installation commands manually. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: INSTALLATION.md:18
• Finding: Credential Configuration File Is Created Without Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `INSTALLATION.md:18-28`; equivalent setup guidance at `SKILL.md:29-34` and `README.md:7-12` **Vulnerability Type**: Insecure storage permissions for API credentials **Risk Level**: Medium ### Vulnerable Code ```bash # 설정 디렉토리 생성 mkdir -p ~/.openclaw/workspace/config # 템플릿 복사 cp /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest/config.template.json \ ~/.openclaw/workspace/config/daily-sales-digest.json ``` The resulting file is intended to contain secrets such as: ```json "clientSecret": "실제_시크릿" ``` ### Technical Analysis The configuration stores Naver client secrets, Coupang secret keys, Baemin API keys, and optional POS API keys. Setup creates the directory and copies the file without explicitly restricting permissions. The resulting mode depends on existing directory permissions and the user’s `umask`. On a multi-user system with permissive defaults, other local users may be able to read the file. Advising users not to commit the file to Git does not protect it from local disclosure. ### Attack Path 1. A user creates the configuration while operating under a permissive `umask` or within a broadly readable parent directory. 2. The user inserts real marketplace or POS credentials. 3. Another local account or process enumerates and reads the configuration file. 4. The exposed credentials are used to access the associated APIs or business data. ### Impact Assessment Exposed credentials may allow unauthorized access within the scopes granted to each API key, potentially including: - Reading seller order and sales information. - Accessing POS sales endpoints. - Consuming API quotas. - Impersonating the merchant integration. The precise scope depends on the permissions assigned to each credential. The issue does not itself grant privileges beyond those credentials. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the configuration directory with owner-only access: ```bash install -d -m 700 ~/.openclaw/workspace/config install -m 600 config.template.json \ ~/.openclaw/workspace/config/daily-sales-digest.json ``` - If the file already exists, enforce permissions with: ```bash chmod 600 ~/.openclaw/workspace/config/daily-sales-digest.json ``` - Verify that the file is owned by the account running OpenClaw. - Prefer a supported operating-system secret store or dedicated secret manager. - Use read-only, least-privilege API credentials and rotate them periodically. - Add runtime checks that reject configuration files readable or writable by group or other users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The archiving example compresses files and then immediately deletes the originals with rm, but provides no warning that removal is irreversible if the archive is incomplete, corrupted, or misplaced. Because this skill handles business sales data, accidental deletion can result in permanent loss of financial records needed for reporting, reconciliation, or compliance.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

tar -czf ~/sales-data-backup.tar.gz ~/.openclaw/workspace/data/sales/

# 스킬 디렉토리 삭제
rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest

# 설정 파일 삭제 (선택)
rm ~/.openclaw/workspace/config/daily-sales-digest.json

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

tar -czf ~/sales-data-backup.tar.gz ~/.openclaw/workspace/data/sales/

# 스킬 디렉토리 삭제
rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest

# 설정 파일 삭제 (선택)
rm ~/.openclaw/workspace/config/daily-sales-digest.json

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest

# 설정 파일 삭제 (선택)
rm ~/.openclaw/workspace/config/daily-sales-digest.json

# 데이터 삭제 (선택)
rm -rf ~/.openclaw/workspace/data/sales/

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm ~/.openclaw/workspace/config/daily-sales-digest.json

# 데이터 삭제 (선택)
rm -rf ~/.openclaw/workspace/data/sales/
```

## 9. 백업 권장사항

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

rm ~/.openclaw/workspace/config/daily-sales-digest.json

# 데이터 삭제 (선택)
rm -rf ~/.openclaw/workspace/data/sales/
```

## 9. 백업 권장사항

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: 설명은 광범위한 매출 집계 및 다채널 리포팅 스킬을 주장하지만, 제공된 코드는 로컬에 이미 저장된 일별 JSON 데이터를 읽어 전일 대비 매출 변화율을 계산하고 임계값 초과 시 경보를 보내는 보조 스크립트입니다. 이는 단순한 지원 세부사항 수준을 넘어서, 주요 목적이 '요약 리포트 생성/배달'이 아니라 '이상 탐지 및 즉시 알림'으로 materially 다릅니다. 또한 실제 구현된 전달 채널은 Discord뿐이며, 선언된 네이버/쿠팡/배민/POS 연동이나 카카오톡/이메일 전송은 코드에 없습니다.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: 설명은 여러 외부 플랫폼과 POS를 실제 연동해 매출 데이터를 수집하고, 요약 리포트를 자동 생성한 뒤 Discord/카카오톡/이메일로 배달하는 완성형 스킬을 나타낸다. 그러나 코드 조각은 collect.js 하나뿐이며, 실제 네이버/쿠팡/배민/POS API 호출은 모두 TODO로 남아 있고 무작위 mock 데이터를 반환한다. 또한 결과는 로컬 JSON 파일로 저장될 뿐, 주간/월간 리포트 생성이나 어떤 전송 채널로의 발송도 수행하지 않는다. 따라서 선언된 핵심 기능과 실제 구현된 동작 사이에 중요한 불일치가 있다.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: 설명은 이 스킬이 여러 외부 판매채널 및 POS와 연동하여 매출 데이터를 수집하고, 생성된 리포트를 Discord/카톡/이메일로 배달한다고 주장한다. 그러나 제공된 코드 조각은 이미 저장된 로컬 JSON 파일을 읽어 요약 통계를 계산하는 리포트 생성기 역할만 수행한다. 외부 API 호출, 인증, 크롤링, 동기화 등 데이터 수집 로직은 없고, 카카오톡 전송도 전혀 없다. Discord 전송은 openclaw CLI 호출로 구현되어 있으나 이메일은 콘솔에 안내를 출력하는 수준이라 설명과 차이가 있다. 따라서 핵심 기능 중 '데이터 수집'과 일부 '전달 채널'이 실제 동작과 불일치하므로 설명이 코드 행동을 정확히 대표하지 않는다.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: 설명과 일부 관련성은 있다. 매출 데이터 수집 및 일일/주간 요약과 연관된 collect.js, digest.js를 호출하므로 전반적 도메인은 일치한다. 그러나 실제 제공된 코드 조각은 고객용 매출 요약/배달 기능 자체가 아니라 테스트 러너다. 또한 선언에 없는 이상 탐지(alert.js) 기능을 실행하고, 로컬 설정 파일 확인 및 데이터 디렉토리 생성 같은 파일시스템 조작을 수행한다. 반대로 선언의 핵심인 Discord/카톡/이메일 배달은 실제 실행되지 않고 cron 명령 예시로만 제시된다. 따라서 설명이 코드 조각의 실제 역할과 기능을 정확히 대표한다고 보기 어렵다.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file claims to collect real sales data from multiple commerce sources, yet every collector fabricates random summaries and then saves them as if they were genuine collected results. Because the skill's stated purpose is automated daily sales reporting and delivery to channels like Discord/KakaoTalk/email, this behavior can propagate false business records to users and external systems, making the deception more dangerous in context.

External Transmission

Medium

• Category: Data Exfiltration

Content

// API 호출 (예시)
  const axios = require('axios');
  
  const response = await axios.get('https://api.commerce.naver.com/external/v1/pay-order/seller-product-order/list', {
    headers: {
      'X-Naver-Client-Id': clientId,
      'X-Naver-Client-Secret': clientSecret

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

// API 호출 (예시)
  const axios = require('axios');
  
  const response = await axios.get('https://api.commerce.naver.com/external/v1/pay-order/seller-product-order/list', {
    headers: {
      'X-Naver-Client-Id': clientId,
      'X-Naver-Client-Secret': clientSecret

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const shopId = config.sources.baemin.shopId;
  
  // API 엔드포인트는 배민 제공 문서 참고
  const response = await axios.get('https://api.baemin.com/v1/sales', {
    headers: {
      'Authorization': `Bearer ${apiKey}`
    },

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples encourage automatic delivery of detailed sales summaries to Discord and email, which are third-party or broadly accessible channels, without any caution about exposing sensitive business metrics to unintended recipients. In the context of a sales-reporting skill, this increases the likelihood of accidental data disclosure through misconfigured channels, shared inboxes, or unauthorized workspace members.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documented use of a force-overwrite option normalizes destructive behavior without warning that existing collected data may be replaced, potentially erasing corrected or historical records. In a financial reporting workflow, unintended overwrites can damage data integrity and lead to inaccurate reports or loss of auditability.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

스킬이 이미 설치되어 있습니다:

```bash
ls -la /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest/
```

### 2.2 설정 파일 생성

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 설정 디렉토리 생성
mkdir -p ~/.openclaw/workspace/config

# 템플릿 복사
cp /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest/config.template.json \

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide tells users to place API client IDs and secrets into a local JSON config file but provides no guidance on file permissions, secret storage, rotation, or avoiding commits/backups. This increases the chance of credential leakage through world-readable files, shell history, backups, or accidental source control inclusion.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installation steps automate sending sales summaries and anomaly alerts to Discord and email without warning that business-sensitive data will be transmitted to third-party channels. Users may unknowingly exfiltrate revenue and operational data to external services with broader retention and access than intended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The removal section includes destructive deletion commands for the skill, config, and collected sales data without an explicit warning that the action is irreversible. This creates a realistic risk of accidental permanent data loss, especially because the same section presents cleanup as routine administration.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 1. 설정 파일 생성

```bash
mkdir -p ~/.openclaw/workspace/config
cp config.template.json ~/.openclaw/workspace/config/daily-sales-digest.json
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README instructs users to automate collection and delivery of sales summaries to external channels such as Discord, KakaoTalk, and email, but it does not warn about sensitive business data leaving the local environment or the need for recipient/channel validation. In a customer-facing sales reporting skill, silent external transmission increases the risk of accidental data disclosure to the wrong workspace, webhook, or email list.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill encourages sending sales summaries to Discord, email, and future KakaoTalk channels without clearly warning that business-sensitive revenue and order data will leave the local environment. In a customer-facing sales reporting skill, this materially increases the chance of unintended disclosure to third-party platforms, misconfigured recipients, or retained message histories.