ClawHub
Back to skill

Security audit

Supermarket Sales

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to fetch supermarket specials as advertised, but it runs browser automation against external websites with Chromium sandboxing disabled and non-reproducible dependency installation.

Review before installing. Run it only in a constrained, unprivileged environment, avoid running npm or browser automation as root, pin dependencies and commit a lockfile before production use, and remove Chromium no-sandbox flags if your host supports normal sandboxing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/fetch_daily.js:14
Finding

Chromium Is Launched with Browser Sandboxing Disabled

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:10
Finding

Puppeteer Dependency and Browser Artifacts Are Not Reproducibly Pinned

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises shell-based execution paths (npm start, node ..., bash ...) but does not declare any tool scope or permission boundaries. That creates an execution-safety gap: an agent or user may run local code with network access and filesystem/process effects without explicit authorization metadata, increasing the risk of unintended command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

Using npx puppeteer without pinning a version can fetch whatever package version is current at execution time, making the environment non-reproducible and exposing users to supply-chain risk if a bad or incompatible release is published. In a skill that encourages command execution, this increases the chance of unexpectedly running unreviewed code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The header comment explicitly states 'Fetches Coles and Woolworths specials for the week'. However, the code contains a real browser-based fetch only for Coles, while Woolworths is handled by printing a URL and search suggestion rather than performing a fetch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description says it fetches sale details from both Woolworths and Coles for comparison or checking current specials. In this file, only Coles is programmatically fetched; the Woolworths section outputs a source label and user instructions instead of retrieving any data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The description restricts the skill to Australian supermarkets, and later narrows performance to Melbourne metro area postcodes. This imposes a locale-specific scope without explicit opt-in language or a clearer justification in the description, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill tells users to run automation scripts and browser-driven scraping but does not clearly warn that these commands will make live requests to Coles and third-party aggregator sites. Lack of disclosure can lead to unexpected outbound traffic, website interaction, and possible policy/compliance issues in restricted environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency on puppeteer uses a caret range (^22.0.0), which allows automatic installation of newer minor and patch releases. This weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious upstream changes without any manifest change in this skill.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"coles": "node scripts/fetch_with_puppeteer.js"
  },
  "dependencies": {
    "puppeteer": "^22.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code hard-codes the locale 'en-AU' when formatting the date, which imposes a specific language/locale choice on all users. The file does not offer a locale choice or document that this skill is intentionally limited to an Australian regional context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The request header explicitly sets Accept-Language: en-US,en;q=0.5, which imposes a specific language/locale preference. Forcing a locale without offering user choice can violate language/locale policy requirements, especially in a general-purpose skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Coles request also hard-codes Accept-Language: en-US,en;q=0.5, enforcing a specific locale preference. This is a natural-language policy concern because the skill does not let the user choose or explain why that locale is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.