Product Differentiation Shopify

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:59 PM UTC
• Version: 0.1.0

Overview

The bundled analyzer looks local, but the install command can run unpinned third-party code globally and the description overstates what the skill actually does.

Review this carefully before installing. Prefer a pinned skills CLI version, an immutable reviewed commit or signed release, and project-scoped installation instead of global installation. Expect the current bundled script to produce a simple local differentiation report, not true Shopify crawling, CAC/LTV analysis, or automated competitor-store research.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Supply-chain risk from an unpinned npx package and mutable Skill source
Risk Level: Medium

Vulnerable Code

bash

npx skills add nexscope-ai/eCommerce-Skills --skill product-differentiation-shopify -g

Technical Analysis

The documented installation command invokes npx skills without specifying an exact package version or integrity constraint. Depending on the local npx cache and environment, npx may retrieve and execute the current registry release of the skills package.

The command also identifies the Skill through the mutable repository reference nexscope-ai/eCommerce-Skills, without pinning it to a reviewed commit hash or cryptographically verified artifact. Consequently, the code and instructions executed during installation can differ from the content originally audited.

This creates a time-of-check/time-of-use supply-chain exposure. If either the package registry entry, publisher account, upstream repository, or release process is compromised, following the documented command could execute or install attacker-controlled content.

Attack Path

1. An attacker compromises the package publisher, package registry entry, upstream repository, or associated release credentials.
2. The attacker publishes a modified version of the skills package or changes the mutable Skill source.
3. A user follows the installation command in SKILL.md.
4. npx retrieves and executes the unpinned package version.
5. The installer retrieves the mutable Skill content and installs it globally through the -g option.
6. Malicious installation logic may execute with the user's privileges, and attacker-controlled Skill content may become available across later agent sessions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the command. Potential effects include access to files ...[truncated 489 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an exact reviewed version rather than allowing npx to resolve the latest release.
2. Pin the Skill source to an immutable, reviewed commit hash or signed release artifact.
3. Publish and verify cryptographic checksums or signatures before execution.
4. Use a lockfile or equivalent integrity metadata where the installation mechanism supports it.
5. Avoid global installation by default; prefer a project-scoped or isolated environment with least privilege.
6. Do not run the installation command with elevated privileges.
7. Document the expected publisher identity, package version, source commit, and verification procedure.
8. Continuously monitor pinned dependencies and deliberately update them only after security review.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code does implement part of the declared concept: it analyzes competitor-related review text, identifies pain points and selling points, builds a comparison matrix, and outputs differentiation and positioning recommendations. However, several prominent claims in the description are not supported by the code. There is no Shopify integration, no store crawling or competitor store analysis, no web scraping, no CAC/LTV computation, and no brand story analysis. The implementation is a standalone keyword-based analyzer over provided product and review data, so the declared description materially overstates and mischaracterizes the skill’s actual capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code hard-codes language selection to English by default and Chinese only via a command-line flag, rather than offering a user-facing language choice inside the skill. Because language/locale policy findings apply to all file types, this is a mild policy concern where output language is constrained by implementation rather than explicit user selection flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.