ClawHub
Back to skill

Security audit

Profit Margin Calculator Walmart

Security checks for vulnerabilities and agentic risk

Overview

This skill claims to be a Walmart seller calculator but ships Amazon FBA calculation logic, with an unpinned global install command.

Review this carefully before installing. It should not be relied on for Walmart/WFS profitability decisions unless the publisher fixes the documentation or implementation mismatch. Prefer a pinned, project-local install from an immutable reviewed source rather than the documented unpinned global npx command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Installer and Mutable Skill Source

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Supply-chain risk caused by unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown
## Installation

```bash
npx skills add nexscope-ai/eCommerce-Skills --skill profit-margin-calculator-walmart -g
text

### Technical Analysis

The documented installation command invokes the unversioned `skills` package through `npx` and installs Skill content globally from `nexscope-ai/eCommerce-Skills`. Neither the npm installer package nor the referenced Skill repository is pinned to an exact, audited version or immutable commit.

When the package is not already available locally, `npx` may download and execute the currently published package. Consequently, the code executed during installation can differ from the version that was originally reviewed. The referenced Skill source is similarly mutable, creating an additional trust boundary in the installation chain.

This finding concerns the installation instructions. The audited `scripts/calculator.py` itself contains no network requests, subprocess execution, persistence, credential access, or malicious embedded behavior.

### Attack Path

1. An attacker compromises, takes over, or otherwise gains publishing access to the `skills` npm package or the referenced Skill repository.
2. The attacker publishes a malicious package release or modifies the mutable repository content.
3. A user follows the documented installation command.
4. `npx` retrieves and executes the current unpinned installer package.
5. The installer retrieves or installs the current mutable Skill content with the invoking user's permissions.
6. Malicious installer logic or modified Skill files execute immediately or when the globally installed Skill is later invoked.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the i
...[truncated 605 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to an exact, reviewed version rather than relying on the current published release.
  2. Pin the Skill source to an immutable commit hash or cryptographically signed release tag.
  3. Publish and verify checksums or signatures for both the installer and installed Skill artifacts.
  4. Use a lockfile and a trusted package registry with integrity verification where supported.
  5. Avoid global installation unless it is operationally necessary; prefer a project-local installation with least-privilege permissions.
  6. Review package lifecycle scripts and transitive dependencies before permitting execution.
  7. Document a verification procedure that users can perform before installation.
  8. Run installation in a sandbox or restricted environment when the provenance of dependencies cannot be independently verified.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

There is a clear description-behavior mismatch. The code explicitly brands itself as an 'Amazon Profit Calculator' and uses Amazon-specific concepts such as FBA fulfillment fees, FBA storage fees, and Amazon referral fee categories/rates. While the declared description says Walmart seller calculations with WFS fees and comparison against Amazon FBA, the supplied code does not contain Walmart or WFS logic at all, nor any comparison engine between marketplaces. It also does not perform any competition or market-advantage analysis. The extra CLI and batch-processing support are secondary undeclared capabilities, but the main issue is that the primary platform and feature set materially differ from the declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill metadata advertises a Walmart profit margin calculator, but the implementation, fee tables, and generated reports are explicitly Amazon/FBA-specific. This creates a deceptive business-logic mismatch that can cause users to make pricing and profitability decisions on the wrong marketplace assumptions, leading to materially incorrect outputs and financial harm.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and output formatting present the tool as an Amazon profit calculator, directly contradicting the Walmart-focused skill context. Even without code execution risk, this inconsistency is dangerous because it misleads users about what business rules are being applied and reduces their ability to detect incorrect fee assumptions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.