Brand Protection Shopify

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:49 AM UTC
• Version: 0.1.0

Overview

The skill is not malicious, but its documentation substantially overstates what the included scripts do and its install command uses an unpinned global installer.

Review this skill carefully before installing. It appears to be a local Amazon-focused demo/template generator, not a Shopify/DTC monitoring tool. Do not rely on it for domain, social media, DMCA, or Shopify abuse coverage unless those capabilities are added and verified. If installing anyway, prefer a pinned version or immutable commit and avoid running the global npx install from a privileged account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Installer Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Unpinned third-party dependency and mutable external installation source
Risk Level: Medium

Vulnerable Code

bash

npx skills add nexscope-ai/eCommerce-Skills --skill brand-protection-shopify -g

Technical Analysis

The documented installation command invokes the third-party skills npm CLI through npx without specifying a reviewed package version or integrity hash. If the package is not already available locally, npx may retrieve and execute the currently published version.

The command also references nexscope-ai/eCommerce-Skills without pinning it to an immutable commit or verified release. Consequently, both the installer and installed content may differ from what was reviewed during this audit. The global installation flag (-g) increases exposure by placing mutable content in a user-wide environment.

This is a supply-chain weakness rather than evidence that the current bundled Python scripts are malicious. No malicious code, network requests, subprocess execution, persistence, credential access, or data exfiltration was identified in the audited Python files.

Attack Path

1. An attacker compromises the npm account/package used by npx, the referenced repository, or its release process.
2. The attacker publishes a malicious package version or modifies the repository content referenced by the installation command.
3. A user follows the installation instructions in SKILL.md.
4. npx retrieves and executes the mutable third-party CLI with the user's privileges.
5. The compromised installer can execute arbitrary commands or install altered Skill content globally.
6. The malicious content may affect subsequent uses within the scope of the invoking user's account.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the command. Potential consequences include access to that ...[truncated 436 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm CLI to an explicitly reviewed version, for example:

   bash

   npx --yes skills@<reviewed-version> add ...
   

2. Pin the external repository to an immutable, reviewed commit hash or signed release rather than a mutable branch or repository head.
3. Verify package integrity through lockfiles, checksums, provenance attestations, or cryptographic signatures.
4. Avoid global installation by default. Prefer a project-local, isolated environment with least-privilege permissions.
5. Publish the expected package owner, version, commit identifier, checksum, and verification procedure in the installation documentation.
6. Review installer lifecycle scripts and transitive dependencies before recommending execution.
7. Do not run the installation command as root or from an account containing unnecessary production credentials.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independent mismatch report indicates the skill claims broad counterfeit, reseller, trademark, domain, social, and DMCA functionality while apparently lacking those core capabilities and focusing on Amazon-oriented workflows instead. In a security context, severe description-behavior mismatch is risky because it can mislead users into skipping real monitoring or enforcement actions based on incorrect assumptions about protection coverage.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second independent mismatch report indicates the skill claims broad counterfeit, reseller, trademark, domain, social, and DMCA functionality while apparently lacking those core capabilities and focusing on Amazon-oriented workflows instead. In a security context, severe description-behavior mismatch is risky because it can mislead users into skipping real monitoring or enforcement actions based on incorrect assumptions about protection coverage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The installation command uses npx skills without pinning an exact package/version, which can cause users to fetch and execute whatever package/version is current at install time. In a supply-chain attack or malicious package update scenario, this could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring lists 'ImageStolenDetection' and 'RiskEvaluate' as features. While risk scoring is implemented, there is no image-theft detection logic using image_urls or logo_url anywhere in the code, so the documentation overstates implemented detection capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a Shopify/DTC brand-protection toolkit with counterfeit stores, unauthorized resellers, trademark violations, DMCA templates, domain monitoring, and social media infringement detection. This file instead implements only in-memory Amazon marketplace listing analysis centered on ASINs, sellers, Brand Registry, and Amazon complaint workflows, with no Shopify, domain-monitoring, social-media, or DMCA-template functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file hard-codes output language selection to English by default and Chinese when a --zh flag is present, but offers no user-facing explanation of locale choice, preference handling, or justification for the bilingual constraint. This is a natural-language policy concern because the skill dictates response language behavior programmatically rather than explicitly offering a documented language choice or region-specific rationale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This file contains natural-language output behavior tied to a fixed locale switch, with Chinese enabled by a command-line flag and English otherwise. While not severe, it reflects a constrained language policy in the skill implementation rather than a more flexible user locale choice, which can conflict with organizational expectations around language opt-in and locale neutrality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.