other
Warning
- Location
README.md:160- Finding
Misleading Privacy Disclosure and Correlatable Session Identifier Transmission
- Content
View full analysis
- Remediation
View remediation
Security audit
pick the best - shopping assistant
Security checks for vulnerabilities and agentic risk
Overview
This shopping skill does what it says, but it may send broad or accidental shopping-related prompts and reusable session identifiers to a third-party service while understating the privacy impact.
Review before installing. Use this only when you intentionally want Pick the Best to process your shopping request. Avoid including sensitive personal details, and do not use usernames, emails, account IDs, or other stable identifiers as session_id values. Be aware that product links may contain affiliate tracking and that unclear markets may default to GB.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger words are extremely generic (for example, 'shop', 'buy', 'product', and 'price') and are likely to activate in ordinary conversation unrelated to intentional skill use. That can cause accidental invocation of the skill and unintended transmission of user queries to a third-party shopping/GPT backend, increasing privacy and consent risk.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes very common words such as "shop," "buy," "product," "deal," and "price," making accidental invocation likely during ordinary conversation. Overbroad activation increases the chance that unrelated user messages will be routed into this skill and then transmitted to the external shopping API without clear intent or consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explains third-party processing only later under privacy details, not as an upfront warning before use. Users may submit shopping queries without realizing their prompts are sent to an external MCP endpoint and GPT-powered backend, which creates a transparency and informed-consent issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Defaulting to the GB market when the user's locale is unclear can silently alter results, pricing, affiliate links, and merchant context without the user's explicit choice. While not a direct code-execution issue, it can mislead users and route their requests to an unintended regional service context, which is a trust and integrity problem in a shopping skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes direct HTTP API usage but does not provide a clear user-facing warning that shopping queries and preferences will be sent to an external third-party service. Users may disclose budgets, gift details, brands, or other personal preference data without realizing it is leaving the host system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill is designed around sending user-provided shopping requests to an external HTTP API via curl, which is a genuine external transmission path. In context this is expected functionality, but it remains security-relevant because potentially sensitive preference data, budgets, and conversational context may be sent off-platform, and the skill does not pair this behavior with clear notice or consent safeguards.
- Content
API Call Example:
bash curl -X POST https://pickthebest.com/gb/en/v1/shopping/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The workflow instructs the agent to infer locale from symbols or context and default to the UK market when unclear, causing user requests to be processed under a guessed jurisdiction and language without confirmation. This can expose user queries to the wrong regional endpoint, produce misleading pricing, and bypass user choice about where their data is sent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to include affiliate tracking links in product responses, introducing monetization behavior that is not clearly disclosed as part of assisting the user. This creates a conflict of interest and can steer recommendations or link handling toward revenue generation rather than user benefit, especially when paired with external product search results.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example trigger phrase, 'I need a birthday gift for my friend,' is broad everyday language that can unintentionally activate the shopping skill in contexts where the user may only be casually asking for ideas. Because the skill is designed to influence purchasing decisions, overly generic triggering increases the chance of unsolicited tool use or context hijacking from normal conversation.
- Content
Static analysis
No suspicious patterns detected.