ClawHub
Back to skill

Security audit

Orderflow

Security checks for vulnerabilities and agentic risk

Overview

This skill needs Review because it asks users to install an unpinned global CLI and connect live commerce credentials to automations that can trigger real fulfillment actions.

Install only after verifying the `orderflow-cli` package source and version, using a sandbox or least-privilege service account, rotating any secrets entered on command lines, and testing with non-production stores, warehouses, carriers, sheets, and notification channels before enabling live workflow activation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:210
Finding

Unpinned Global Installation of an Unaudited npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:210-211
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code

bash
npm install -g orderflow-cli
orderflow init

Technical Analysis

The setup instructions install orderflow-cli globally without specifying an exact version or verifying its integrity. The project contains no lockfile, checksum, package signature, vendored source, or other mechanism that binds installation to a reviewed artifact.

npm installation can execute package lifecycle scripts. Global installation also adds package-provided executables to the user's environment and potentially to PATH. Consequently, the effective code executed by these instructions can change after this skill has been reviewed.

The audit did not establish that orderflow-cli is malicious. The confirmed weakness is that the instructions place trust in an unpinned and unaudited external package.

Attack Path

  1. An attacker compromises the package, a maintainer account, or the relevant package-distribution path.
  2. The attacker publishes a malicious or backdoored release under the expected package name.
  3. A user follows the documented command, which resolves the package version available at installation time.
  4. Malicious lifecycle code may execute during installation, or malicious behavior may run when orderflow init is invoked.
  5. The installed program executes with the privileges of the installing user and may later receive access to the integration credentials described by the skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on that user's access, the compromised package could read user-accessible files and environment variables, alter local configuration, install or replace executables, and capture credentials subsequently provided to the ...[truncated 155 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, independently reviewed version rather than resolving the latest release.
  • Supply and enforce a lockfile and verify package integrity using trusted hashes or signatures.
  • Document the authoritative package registry, publisher identity, source repository, and release-verification process.
  • Prefer a project-local installation over npm install -g.
  • Disable or carefully review lifecycle scripts where operationally feasible.
  • Execute the dependency in a sandbox or isolated service account with minimal filesystem, network, and credential access.
  • Review package ownership and source changes before upgrading.
  • Integrate dependency scanning and provenance verification into the release process.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:216
Finding

Integration Secrets Passed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:216-218
Vulnerability Type: Plaintext credential exposure through process arguments and shell history
Risk Level: High

Vulnerable Code

bash
orderflow auth shopify --api-key YOUR_KEY --api-password YOUR_PASSWORD
orderflow auth warehouse --token YOUR_TOKEN
orderflow auth slack --webhook YOUR_WEBHOOK_URL

Technical Analysis

The authentication examples instruct users to substitute credentials directly into command-line arguments. Real values entered this way may be retained in shell history, terminal transcripts, CI/CD logs, command auditing systems, or process-monitoring telemetry. On applicable systems, other local processes or users may also be able to inspect process arguments while the commands are running.

This practice conflicts with the statement at SKILL.md:375 that credentials are “never logged or transmitted in plain text.” The documentation provides no evidence that the CLI masks command arguments or removes them from external logging surfaces.

Attack Path

  1. A user replaces the placeholders with live Shopify credentials, a warehouse API token, and a Slack webhook URL.
  2. The shell records the command, an automation platform logs it, or a local observer captures the process arguments.
  3. An attacker with access to that history, log, telemetry source, or process listing retrieves the exposed secret.
  4. The attacker reuses the credential against the corresponding external service.
  5. Access persists until the affected secret expires, is revoked, or is rotated.

Impact Assessment

The attainable privileges depend on each credential's server-side permissions:

  • Shopify credentials: May permit access to store data or commerce operations within the configured API scopes.
  • Warehouse token: May expose inventory data or permit warehouse operations allowed by the token.
  • Slack webhook URL: Typically permits unau ...[truncated 299 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove examples that place secrets directly in command-line arguments.
  • Have the CLI obtain secrets from a protected credential manager, operating-system keychain, or interactive no-echo prompt.
  • If environment variables are supported, pass only variable names to the CLI and prevent secret values from being printed; note that environment exposure must still be restricted.
  • Support secret input through standard input or a protected file descriptor when a credential manager is unavailable.
  • Set restrictive permissions on any necessary credential files and delete temporary material securely.
  • Redact secrets from application logs, shell tracing, CI/CD output, crash reports, and telemetry.
  • Document least-privilege API scopes and credential expiration and rotation procedures.
  • Advise users who followed the existing examples to remove affected shell-history entries and rotate any credentials that may have been recorded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
"files": ["SKILL.md"],

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The setup instructions tell users to pass API keys, passwords, and webhook URLs directly on the command line, while later claiming secrets are never logged or transmitted in plain text. Command-line arguments are commonly exposed via shell history, process listings, audit logs, CI job output, and endpoint telemetry, creating a real risk of credential disclosure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description and the body of SKILL.md present this skill as a production-grade automation system handling Shopify, WooCommerce, 3PLs, shipping carriers, Google Sheets, Slack, SMS, and more. However, the file contains only documentation, example prompts, and setup text; there is no executable code in this artifact implementing those behaviors, so the claimed functionality does not match the actual file contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill prominently promotes integrations with Shopify, Slack, Google Sheets, Twilio, SendGrid, and other external services, but does not provide a clear up-front warning that order, customer, inventory, and operational data may be transmitted to third parties. In this e-commerce context, that omission increases the chance of users unintentionally disclosing sensitive business or customer data outside their environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill encourages automatic label generation, routing, and notifications without an explicit warning that these actions may trigger real shipments, inventory reservations, customer communications, and downstream costs that are difficult to reverse. In fulfillment operations, such automation can cause accidental operational and financial harm if misconfigured or invoked on live systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.