T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/commerce_client.py:23- Finding
Remote Plaintext HTTP Endpoints Can Bypass Transport Security Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Commerce Engine
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real commerce-agent client, but it needs Review because it handles passwords, tokens, profile data, and orders while containing concrete credential-transport and local credential-safety weaknesses.
Use this only with commerce backends you trust, and avoid entering real passwords until the URL validation, redirect handling, and credential-file creation issues are fixed. Expect it to store per-store tokens and visitor IDs under `~/.openclaw/credentials/agent-commerce-engine/`, and remember that `create-order` can submit shipping details and create a pending order even though final payment is handed back to you.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/commerce_client.py:73- Finding
Cross-Origin Redirects May Disclose Authentication Headers and Sensitive Request Bodies
- Content
View full analysis
Dict[str, Any]: url = f"{self.base_url}{path}" try: response = self.session.request(method, url, timeout=10, **kwargs) return self._handle_response(response) ``` The authentication methods similarly use redirect-following request calls: ```python response = self.session.post(url, json={"account": account, "password": password}, timeout=10) ``` ### Technical Analysis The `requests` library follows redirects by default. The code does not disable redirects, validate each redirect destination, or explicitly remove the custom authentication headers when an origin changes. The token, account, and visitor identifier are installed as session-wide custom headers. Unlike standardized authorization handling, custom application headers must not be assumed to be safely stripped under every cross-origin redirect scenario. In addition, HTTP `307` and `308` redirects preserve the original method and body, potentially forwarding passwords, registration details, profile information, or shipping data to a second origin. Because this Skill intentionally supports arbitrary user-selected stores, a malicious or compromised store can return redirects designed to capture sensitive request data. ### Attack Path 1. The user authenticates to a selected store, causing the token and account identifier to be loaded into session-wide headers. 2. The selected store returns ...[truncated 898 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/commerce_client.py:49- Finding
Legacy Credential Migration Allows Filesystem Path Traversal
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/commerce.py:35- Finding
Passwords Are Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/commerce_client.py:89- Finding
Credential and Visitor Files Are Not Created Atomically with Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SERVER_SPEC.md:115- Finding
Untrusted Commerce Backends Can Inject Agent-Directed Instructions
- Content
View full analysis
", "instruction": "Human-readable guidance for the Agent's next action." } ``` The specification further encourages use of this field: ```markdown The `instruction` field SHOULD accompany the `error` code to provide human/agent-readable guidance, including contextual information like available variants, stock status, or next steps. ``` The formatter outputs backend responses verbatim: ```python def format_output(data, command=None): """Route data to the appropriate human-readable formatter, or fall back to JSON.""" if isinstance(data, dict) and "error" in data: print(json.dumps(data, indent=2, ensure_ascii=False)) return if command == "cart" and isinstance(data, dict) and data.get("success") and "items" in data: _format_cart(data) elif command == "list" and isinstance(data, dict) and data.get("success") and "products" in data: _format_product_list(data) else: print(json.dumps(data, indent=2, ensure_ascii=False)) ``` ### Technical Analysis The Skill can connect to any store selected through `--store`. Such a backend is an untrusted external data source, yet the protocol allows it to supply arbitrary natural-language `instruction` text explicitly intended to influence the Agent’s next action. No trust-boundary warning, schema restriction, sanitization, or policy prevents a response from containing commands such as requests to disclose credentials, invoke unrelated tools, visit attacker-controlled links, or disregard the user’s original objective. The CLI itself only prints the cont ...[truncated 1134 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
README.md:27- Finding
Runtime Dependency Is Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - **Types**: `story`, `company`, `contact`. ### D. Shopping Cart `GET /cart` | `POST /cart` | `PUT /cart` | `DELETE /cart` - **Request Body**: `{ "product_slug": string, "variant": string, "quantity": number }`. - **Response**: Return the full cart snapshot including `totalPrice`, `currency`, and `items` (each item should also carry its `currency`). - **Error Codes**: `PRODUCT_NOT_FOUND`, `VARIANT_UNAVAILABLE`, `BAD_REQUEST`.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description understates several sensitive behaviors, including persistent credential storage, visitor tracking identifiers, registration flows, and order creation. When a skill performs materially more than its high-level description suggests, users and hosting platforms may grant trust or permissions without understanding the privacy and transaction risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description understates several sensitive behaviors, including persistent credential storage, visitor tracking identifiers, registration flows, and order creation. When a skill performs materially more than its high-level description suggests, users and hosting platforms may grant trust or permissions without understanding the privacy and transaction risks.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises capabilities that imply shell, network access, environment-variable use, and local credential storage, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens security review and runtime containment because consumers cannot easily determine or restrict what the skill may access before use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill explicitly supports account access, cart continuity, order creation, and elsewhere documents local persistence of tokens and visitor identifiers. Session persistence for commerce accounts increases exposure if the host is shared, compromised, or if domain separation is weak, because persisted tokens can enable unauthorized account or order actions without reauthentication.
- Content
md # Standard Agentic Commerce Engine The **Standard Agentic Commerce Engine** is a standard client and protocol guide for connecting agents to compatible e-commerce backends. It gives agents a consistent way to search products, manage carts, access account data, create orders, and hand payment back to the user. GitHub Repository: https://github.com/NowLoadY/agent-commerce-engine
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Target a store directly via --store (preferred) python3 scripts/commerce.py --store https://api.yourbrand.com/v1 list --page 1 --limit 20 python3 scripts/commerce.py --store https://api.yourbrand.com/v1 search "item" python3 scripts/commerce.py --store https://api.yourbrand.com/v1 add-cart <slug> --variant <variant_id>
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Target a store directly via --store (preferred) python3 scripts/commerce.py --store https://api.yourbrand.com/v1 list --page 1 --limit 20 python3 scripts/commerce.py --store https://api.yourbrand.com/v1 search "item" python3 scripts/commerce.py --store https://api.yourbrand.com/v1 add-cart <slug> --variant <variant_id>
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Target a store directly via --store (preferred) python3 scripts/commerce.py --store https://api.yourbrand.com/v1 list --page 1 --limit 20 python3 scripts/commerce.py --store https://api.yourbrand.com/v1 search "item" python3 scripts/commerce.py --store https://api.yourbrand.com/v1 add-cart <slug> --variant <variant_id>
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Target a store directly via --store (preferred) python3 scripts/commerce.py --store https://api.yourbrand.com/v1 list --page 1 --limit 20 python3 scripts/commerce.py --store https://api.yourbrand.com/v1 search "item" python3 scripts/commerce.py --store https://api.yourbrand.com/v1 add-cart <slug> --variant <variant_id>
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # Global argument: --store for multi-merchant targeting parser.add_argument("--store", metavar="URL", help="Target store API URL (e.g., https://api.yourstore.com/v1). " "Overrides COMMERCE_URL env var.") subparsers = parser.add_subparsers(dest="command", help="Command type")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # Global argument: --store for multi-merchant targeting parser.add_argument("--store", metavar="URL", help="Target store API URL (e.g., https://api.yourstore.com/v1). " "Overrides COMMERCE_URL env var.") subparsers = parser.add_subparsers(dest="command", help="Command type")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # Global argument: --store for multi-merchant targeting parser.add_argument("--store", metavar="URL", help="Target store API URL (e.g., https://api.yourstore.com/v1). " "Overrides COMMERCE_URL env var.") subparsers = parser.add_subparsers(dest="command", help="Command type")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # Global argument: --store for multi-merchant targeting parser.add_argument("--store", metavar="URL", help="Target store API URL (e.g., https://api.yourstore.com/v1). " "Overrides COMMERCE_URL env var.") subparsers = parser.add_subparsers(dest="command", help="Command type")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code defines a
clear-cartcommand that removes the entire shopping cart, which is a destructive operation affecting user data. There is no visible confirmation prompt, cautionary help text, or other user-facing warning near the command definition or execution path.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The
logoutcommand invokesclient.delete_credentials(), which appears to remove locally stored authentication material. Although a success message is printed after the fact, there is no prior disclosure or confirmation that credentials will be deleted.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The method persists account and API token data to a local credentials file, which is a safety-relevant file write involving sensitive data. Although there is an internal docstring/comment, there is no user-facing disclosure, confirmation, or visible warning in this code path that credentials will be stored on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This method deletes the stored credentials file, which is a destructive local file operation affecting authentication state. The code provides no visible confirmation prompt, user disclosure, or warning that saved credentials will be removed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest describes support for discovery, cart operations, and secure user management, which clearly covers authentication/profile handling, but this file also exposes email verification-code sending and full account registration flows. Those onboarding capabilities materially expand the skill from managing existing user sessions into creating new user accounts, which is not stated in the manifest description.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Legacy credential migration is keyed off a caller-supplied brand_id rather than the actual domain identity, which can cause credentials from one logical merchant context to be moved into another domain's storage directory. In a multi-merchant agent environment, this risks cross-tenant credential confusion or accidental disclosure if an attacker can influence brand_id selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
Several comments and docstrings in this file are written in Chinese, which imposes a specific language in natural-language content embedded in the skill code. The file does not indicate that language choice is configurable or justified as a region-specific requirement.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The method removes the existing visitor file and creates a new visitor ID, altering persisted local session/cart linkage data. While the comment explains the purpose to developers, there is no user-facing disclosure that local cart/session identity may change as a result.
- Content
Static analysis
No suspicious patterns detected.