Product Description Generator

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:04 PM UTC
• Version: 0.1.0

Overview

This is a straightforward e-commerce copywriting skill, with install and URL-fetching risks users should handle carefully.

Before installing, prefer a pinned release or commit instead of an unpinned global npx command. When using the skill, provide only public marketplace or store URLs you trust, and treat fetched competitor pages as untrusted product data, not instructions for the agent to follow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Global Installation from Mutable Third-Party Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-22
Vulnerability Type: Unpinned third-party dependency and mutable supply-chain source
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npx skills add nexscope-ai/eCommerce-Skills --skill product-description-generator -g

For Amazon listings, use our dedicated skill with Cosmo algorithm optimization:

bash

npx skills add nexscope-ai/Amazon-Skills --skill amazon-listing-optimization -g

See: amazon-listing-optimization

text

### Technical Analysis

The documented installation commands invoke the `skills` package through `npx` without pinning a package version. They also install Skills from GitHub repositories without specifying an immutable commit hash, signed release, checksum, or other integrity constraint.

Both the npm-resolved command and repository contents are therefore mutable after this Skill has been reviewed. The use of the global installation option (`-g`) increases the scope of any compromised content because it can make the installed Skill available outside the current project or session.

This is a supply-chain weakness rather than evidence that the currently referenced repositories are malicious. Exploitation depends on compromise or unauthorized modification of an upstream package, repository, release process, or maintainer account.

### Attack Path

1. An attacker compromises the npm package used by `npx`, one of the referenced GitHub repositories, or an authorized maintainer account.
2. The attacker publishes altered package behavior or replaces Skill content on the mutable branch.
3. A user follows the installation command after the upstream content has changed.
4. `npx` resolves the unpinned package, and the installation command obtains the current repository content rather than the audited revis
...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an explicitly reviewed version, for example by using an exact npm package version rather than allowing npx to resolve the latest release.
2. Reference each GitHub-hosted Skill by an immutable commit hash or a signed, versioned release.
3. Publish and verify cryptographic checksums or signatures before installation.
4. Remove -g unless global installation is operationally necessary; prefer a project-scoped installation with restricted permissions.
5. Record the exact reviewed CLI version, repository revision, and integrity value in the installation documentation.
6. Use dependency monitoring and repeat the security review before updating any pinned version.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:121

Finding

Unrestricted Fetching of User-Controlled URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:121-130
Additional Locations: SKILL.md:194-204, SKILL.md:218-225
Vulnerability Type: Missing URL validation and untrusted remote-content isolation
Risk Level: Low

Vulnerable Code

markdown

**If competitor URLs provided:**

1. Fetch each competitor page:
   ```
   Use web_fetch on each competitor URL.
   Extract: title, bullets/features, description, price, review count, brand name.
   ```

2. If `web_fetch` fails or returns incomplete data:
   ```
   Fallback: web_search for "[product title from URL]" site:[platform].com

Equivalent instructions later direct the Agent to call web_fetch on an existing-listing URL and on each competitor URL. The workflow does not state that URLs must belong to supported marketplace domains, resolve only to public addresses, use HTTPS, or pass redirect validation.

Technical Analysis

The Skill accepts competitor and product URLs from the user and instructs the Agent to fetch them directly. No validation requirements are defined for:

• URL schemes;
• destination hostnames;
• loopback, private, link-local, or metadata-service addresses;
• embedded credentials or unusual ports;
• redirects to prohibited destinations;
• DNS rebinding or resolution changes;
• instructions embedded in fetched page content.

If the host Agent's web_fetch implementation does not independently enforce network isolation, this creates a potential server-side request forgery path. A supplied URL could cause the fetcher to contact a service reachable from the Agent environment but not directly reachable by the user.

Fetched pages are also attacker-controlled input. Because the Skill does not explicitly require remote text to be treated only as product data, a malicious page could include prompt-injection content designed to influence later analysis or generated output. Whether either issue is exploitable depends ...[truncated 1666 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only https:// URLs.
2. Allowlist the documented marketplace domains and their explicitly trusted subdomains.
3. Resolve the destination before each request and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.
4. Reject embedded credentials, nonstandard ports, malformed hostnames, and unsupported URL schemes.
5. Revalidate every redirect destination and enforce a small redirect limit.
6. Protect against DNS rebinding by validating the address actually used for the connection.
7. Run fetching in a network sandbox that cannot reach internal services or metadata endpoints.
8. State explicitly that fetched pages are untrusted data and that any instructions found in them must be ignored.
9. Extract only expected product fields using a constrained parser, and pass structured fields rather than entire pages into subsequent Agent reasoning.
10. If a URL fails validation or extraction is incomplete, ask the user to paste the relevant listing fields instead of fetching an unrestricted destination.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command invokes npx skills add ... -g without pinning a specific package/version, which means the code or package resolved at execution time could change unexpectedly. If the upstream package, dependency chain, or registry resolution is compromised, users may install and run unintended code with their local user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This command also relies on npx skills without a pinned version, creating a supply-chain risk through mutable package resolution. Because it is presented as a recommended installation path for another skill, it may encourage users to execute unversioned code from the ecosystem without reproducibility or trust guarantees.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.