eBay Lister

• Outcome: Review
• Latest audit: Aug 3, 2026 · 8:26 PM UTC
• Version: 1.0.2

Overview

The skill is upfront about making live eBay listings, but it can act on a signed-in account and run an optional shell notification command, so users should review it carefully before installing.

Install only if you intentionally want an agent to control a signed-in Chrome session and create real eBay drafts or listings. Prefer dry-run or draft mode, review title, price, category, shipping, photos, and condition yourself before publishing, use a dedicated browser profile, and leave notifyCommand unset unless you fully trust the exact command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions while instructing use of network access, environment-dependent configuration, and execution of local tooling that can drive a logged-in browser session. This under-declaration prevents meaningful user review and consent, and hides the real trust boundary of a skill that can publish actions to a third-party account.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior presents the skill as an item-analysis and listing assistant, but the actual behavior includes account-affecting automation, optional external command execution for notifications, and browser-start logic not prominently disclosed in the main purpose statement. This mismatch is dangerous because users may consent to a benign-seeming listing workflow without understanding that the skill can execute local commands and manipulate a logged-in browser to publish live listings.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The configuration exposes a generic post-action shell command hook (`notifyCommand`) that runs after publish/draft/block and receives dynamic report content via stdin and an environment variable. In a skill that already automates a logged-in browser session and may process untrusted listing data, this creates an unnecessary command-execution extension point that can be abused or misconfigured to execute unsafe local actions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script executes `CONFIG.notifyCommand` via `spawnSync(..., { shell: true, ... })`, meaning any string in local configuration is treated as a shell command. In the context of an agent skill, this creates a command-execution hook unrelated to the core listing task, and if an attacker can influence the config or installation environment they can run arbitrary OS commands with the user's privileges, potentially exfiltrating listing data, browser state, or other local secrets.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly advertises that the tool will publish a real, live eBay listing, but it does not present a prominent safety warning or emphasize that this is an irreversible external action that can create financial, reputational, and account-level consequences. In this skill’s context, the risk is elevated because the automation drives a logged-in browser session and can act directly on the user’s eBay account, so a user may trigger publication without fully appreciating that the action is not merely drafting or previewing.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad natural-language patterns such as 'sell this' and 'throw it up', which can cause unintended activation from ordinary conversation. In this skill's context, accidental triggering is more dangerous than usual because activation can lead to preparing and ultimately publishing a live eBay listing through an authenticated browser session.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill prominently advertises that it will publish a LIVE eBay listing through a logged-in Chrome session, but does not present a strong, front-loaded warning about the risk of creating real listings on the user's account. Because the action is irreversible in practical terms and can create financial, reputational, and policy consequences, the lack of a prominent warning and consent checkpoint materially increases the chance of harmful misuse or user surprise.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The `notifyCommand` documentation explicitly permits any shell command and does not define safety boundaries, trusted input assumptions, or trigger restrictions. Because the command is fed a generated report through stdin and `EBAY_LISTER_MESSAGE`, operators may compose shell pipelines that accidentally treat attacker-controlled listing text as code or arguments, turning a notification feature into a command-injection sink.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"main": "list.js",
  "type": "commonjs",
  "dependencies": {
    "playwright-core": "^1.59.1"
  }
}

• Confidence: 93% confidence
• Finding: "playwright-core": "^1.59.1"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: list.js:143

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: list.js:75

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: ebay-lister.config.example.json:4