Etsy Seo

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:04 PM UTC
• Version: 0.1.0

Overview

This is a local Etsy SEO helper with an unpinned global install command and some overstated features, but I found no credential access, persistence, exfiltration, or destructive behavior in the artifact.

Install only from a trusted package source, avoid running the npx install command with administrator privileges, and prefer a pinned installer version if available. Expect a local heuristic SEO report rather than real competitor, trend, or search-volume research.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Package Execution During Global Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx skills add nexscope-ai/eCommerce-Skills --skill etsy-seo -g

Technical Analysis

The documented installation command invokes the skills npm package through npx without specifying an exact version or integrity constraint. Consequently, installation can retrieve and execute whichever package version the configured registry resolves at that time. The -g option also causes the Skill to be installed globally.

This creates a supply-chain risk because the code executed during installation can differ from the code reviewed in this audit. If the package account, package registry, dependency chain, or a future package release is compromised, the installation command could execute attacker-controlled package CLI or lifecycle code with the privileges of the user running npx.

No malicious behavior was found in the reviewed local Python implementation. In particular, scripts/analyzer.py contains no network requests, subprocess execution, dynamic evaluation, sensitive-file access, credential collection, persistence mechanisms, or data-exfiltration behavior. The vulnerability is limited to the unsafe, unpinned installation procedure documented in SKILL.md.

Attack Path

1. An attacker compromises the npm package, its maintainer account, its dependency chain, or the registry resolution path.
2. The attacker publishes or causes resolution to a malicious version of the unpinned skills package.
3. A user follows the documented command and executes npx skills ....
4. npx downloads and runs the currently resolved package code without enforcing a reviewed version or integrity hash.
5. Malicious CLI or lifecycle code executes under the installing user's account.
6. The malicious package may access data available to that user, ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to a specific, audited version rather than relying on the latest registry resolution:

   bash

   npx --yes skills@<audited-exact-version> add nexscope-ai/eCommerce-Skills --skill etsy-seo
   

2. Verify the selected package version and its dependency tree before publication of the installation instructions.
3. Use a lockfile-backed installation workflow and enforce package integrity hashes where supported.
4. Document the expected package registry and prevent fallback to untrusted or unexpected registries.
5. Avoid global installation unless it is operationally necessary. Prefer a project-local installation performed under a non-privileged account.
6. Advise users not to run the installation command with sudo, root, or administrator privileges.
7. Consider distributing a reviewed, versioned installer artifact whose checksum or signature can be independently verified.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/analyzer.py (reported line 59)May include surrounding context.

python

"oversized sweater", "matching set", "loungewear", "festival outfit",
    ],
    "accessories": [
        "leather wallet", "handmade bag", "personalized keychain",
        "phone case", "hair accessories", "scrunchie", "tote bag",
        "crossbody bag", "beanie", "scarf", "belt", "sunglasses chain",
    ],

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The installation command uses npx skills without pinning a specific package version, which allows whatever version is current at execution time to be fetched and run. If the upstream package is compromised, typosquatted, or later publishes malicious code, users installing the skill could execute untrusted code during setup.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level documentation explicitly claims features including 'Competitor SEO Analyze' and 'Store SEO Optimization'. However, the code never analyzes competitor data, never processes ShopInfo in any analysis flow, and returns competitor_insights as an empty list, so the documentation actively overstates implemented behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest advertises keyword research, long-tail keyword suggestions, and broader SEO capabilities such as competitor and store SEO optimization. In this implementation, keyword suggestions come only from a hardcoded local dictionary, competitor_insights is always returned as an empty list, and there is no code analyzing shop/store data despite the module docstring listing those features.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sets English only as a fallback, but the data model and output include Chinese-specific fields and the CLI explicitly switches locale behavior based on a flag. This creates a language-specific behavior path in the skill that is not accompanied by any user choice beyond a hardcoded command-line switch, which can violate language/locale policy expectations if the skill is invoked without explicit locale selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.