Supply Chain Optimization Walmart

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:24 PM UTC
• Version: 0.1.0

Overview

This appears to be a local supply-chain calculator, but its Walmart-specific financial claims are overstated and its documented global install command is mutable and unpinned.

Review this carefully before installing. Treat the output as a rough calculator, not authoritative Walmart Marketplace financial guidance, and validate fee, payment-cycle, and ad-spend formulas yourself. Prefer a pinned CLI version, an immutable repository commit or signed release, and project-local installation; avoid entering real Walmart credentials because the bundled code does not use the documented API integration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Installation Chain

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned executable package and mutable remote repository installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add nexscope-ai/eCommerce-Skills --skill supply-chain-optimization-walmart -g

Technical Analysis

The documented installation command invokes npx without pinning the skills package to an audited version. Depending on the local environment and npm behavior, npx may retrieve and execute the current package release from the configured npm registry.

The command also identifies the nexscope-ai/eCommerce-Skills repository without specifying an immutable commit or content digest. Consequently, the code or instructions installed by this command may differ from the content reviewed during this audit. The -g option additionally installs the resulting Skill globally, increasing its availability and exposure beyond a single isolated project.

This is a supply-chain trust issue rather than evidence that the currently bundled calculator is malicious. No malicious behavior was identified in scripts/calculator.py.

Attack Path

1. An attacker compromises the publisher account, package, registry delivery path, or referenced repository.
2. The attacker publishes a malicious skills package release or modifies the repository content referenced by the mutable repository name.
3. A user follows the installation command from SKILL.md.
4. npx retrieves and executes the unpinned CLI package.
5. The CLI retrieves mutable Skill content and installs it globally.
6. Malicious installer logic may execute immediately with the invoking user's privileges, or malicious Skill instructions and scripts may become available during subsequent agent sessions.

Successful exploitation depends on compromise or malicious mutation of an upstream dependency; the reviewed artifact does not itself perform this compromise.

Impact Assessment

A comprom ...[truncated 605 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI package to a reviewed, exact version, for example npx skills@X.Y.Z, rather than resolving the latest available release.
2. Pin the Skill repository content to an immutable commit identifier or signed release tag.
3. Verify package integrity through lockfiles, registry integrity hashes, provenance attestations, or cryptographic signatures.
4. Avoid global installation by default. Prefer a project-local, isolated installation with the minimum required permissions.
5. Review the CLI package and resolved Skill content before execution, especially installation hooks and files under scripts/.
6. Use a trusted registry and repository source, enable publisher multi-factor authentication, and monitor upstream releases for unauthorized changes.
7. Document the exact expected package version, repository revision, and integrity value so users can reproduce the audited installation.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code broadly fits the idea of a supply-chain/cash-flow/inventory analysis tool, so the overall domain is related. However, the declared description is specifically about Walmart Marketplace sellers and claims capabilities such as WFS cost analysis, referral fee diagnosis, Amazon FBA comparison, lower storage fee optimization, and Walmart Connect ad spend analysis. The supplied code does not implement those features in a platform-specific way. Instead, it performs a generic per-unit profitability and cash-cycle analysis with benchmark thresholds by platform. It includes a single generic fulfillment fee field named fba_fee, a storage fee, and a generic advertising ratio, but no Walmart referral fee model, no WFS-specific breakdown, no Walmart Connect-specific analytics, and no side-by-side Amazon comparison engine. Additionally, the code supports TikTok and Shopify, indicating a broader generic ecommerce analyzer rather than the narrowly described Walmart-focused tool. Therefore, the description materially overstates and mischaracterizes the implemented behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises Walmart-specific fee and optimization analysis, but the implemented formulas are Amazon/FBA-centric and omit the promised Walmart-specific logic. In a financial decision-support context, this can mislead sellers into acting on incorrect cost and margin estimates, causing operational or monetary harm even though it is not a classic code-execution flaw.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code hardcodes a 14-day Amazon payment cycle while presenting platform-specific benchmarking, so Walmart, TikTok, and Shopify analyses can produce systematically wrong cash-cycle outputs. Because this skill is marketed for supply-chain bottleneck and cash-flow analysis, incorrect payment timing can directly distort financing, purchasing, and inventory decisions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a 'Supply Chain Bottleneck Analyzer for Walmart Marketplace sellers' with Amazon FBA comparison, but this code contains full benchmark configurations for multiple non-Walmart platforms, including TikTok and Shopify, and allows selecting them directly via the platform field. That expands the operational scope from Walmart-centric analysis to a general multi-marketplace analyzer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code generates fixed natural-language summaries, headings, issue labels, and recommendations in English strings only. The file provides no mechanism for the user to choose another language or locale, which matches the policy-violation criterion for forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.