Security audit

Walmart Review Checker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a review analyzer, but its Walmart-specific claims do not match the Amazon-oriented implementation and its reporting path has avoidable browser-scripting risk.

Review carefully before installing. The package does not appear to steal credentials, install backdoors, or run destructive commands, but it should not be trusted as a Walmart-specific authenticity checker in its current form. Use only in an isolated/local scope, avoid opening generated HTML reports from untrusted review data, and prefer a release that pins installation dependencies, fixes the Walmart/Amazon mismatch, and escapes report content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/report_html.py:348
Finding: Stored HTML and JavaScript Injection in Generated Reports
Content: View full analysis
Review Analysis Report - {asin} ``` ```python
Summary: {summary}
... {"".join([f'''

{d.get('status', '❓')}

{d.get('name', d.get('name_zh', ''))}

{d.get('score', 0):.0f}/100

{d.get('detail', d.get('detail_zh', ''))}
''' for d in dimensions])} ``` ```python // SuspiciousReview const suspicious = {suspicious_json}; const container = document.getElementById('suspiciousReviews'); if (suspicious.length === 0) {{ container.innerHTML = '
No highly suspicious reviews detected.
'; }} else {{ suspicious.slice(0, 5).forEach((review, index) => {{ container.innerHTML += `

#${{index + 1}} Risk: ${{review.risk_score?.toFixed(0) || 'N/A'}}%

"${{review.content}}"

Reasons: ${{(review.reasons || review.reasons_zh || [] ...[truncated 2273 chars]
Remediation: View remediation
", "\\u003e") .replace("&", "\\u0026") ) ``` A safer design is to place JSON in a non-executable ``, ``, quotes, ampersands, and Unicode edge cases. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/report_html.py:56
Finding: Unpinned Third-Party JavaScript Executed by Generated Reports
Content: View full analysis
``` ### Technical Analysis Every generated report references the latest package version resolved by the unversioned `chart.js` CDN path. The dependency is fetched and executed when the report is opened with network access. Because neither an exact version nor a Subresource Integrity hash is specified, the effective JavaScript payload can change after the Skill has been reviewed. A package compromise, CDN compromise, or incompatible future release would affect previously generated reports as well as new ones. ### Attack Path 1. The Chart.js package, its publication account, or the CDN delivery path is compromised or changed. 2. A user opens a generated report while connected to the network. 3. The browser retrieves JavaScript from the mutable CDN URL. 4. The browser executes that script in the report's page context. 5. Malicious code can inspect or modify the report and initiate browser-based network activity. ### Impact Assessment A compromised dependency could execute arbitrary JavaScript in every report that loads the affected CDN resource. This could allow report manipulation, disclosure of report contents, phishing, or unauthorized network requests from the browser. The script executes with browser-page privileges rather than operating-system privileges. The precise scope remains subject to browser origin and local-file security restrictions. ]]>
Remediation: View remediation
/dist/chart.umd.min.js" integrity="sha384-" crossorigin="anonymous"> ``` 3. Prefer bundling a reviewed local copy of Chart.js with the Skill so reports do not execute mutable remote code. 4. Maintain a dependency update process that reviews release notes and regenerates integrity hashes. 5. Apply a Content Security Policy that restricts scripts to explicitly approved local or integrity-protected sources. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Global Installation Through npx
Content: View full analysis
Remediation: View remediation
add ... ``` 2. Pin the Skill repository to an immutable signed release or commit hash. 3. Publish and verify cryptographic checksums or signatures for released Skill artifacts. 4. Avoid global installation unless it is required. Prefer a project-local or isolated installation scope. 5. Document the expected package owner, repository URL, release identifier, and verification procedure. 6. Review package lifecycle scripts and installer behavior before recommending execution. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The reported branding/output mismatch, lack of Walmart-specific logic, and absence of actual analysis suggest deceptive or severely inaccurate capability claims. In a trust-and-safety context, that can directly undermine user decisions by presenting non-existent protections or precomputed results as real analysis.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The reported branding/output mismatch, lack of Walmart-specific logic, and absence of actual analysis suggest deceptive or severely inaccurate capability claims. In a trust-and-safety context, that can directly undermine user decisions by presenting non-existent protections or precomputed results as real analysis.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The reported branding/output mismatch, lack of Walmart-specific logic, and absence of actual analysis suggest deceptive or severely inaccurate capability claims. In a trust-and-safety context, that can directly undermine user decisions by presenting non-existent protections or precomputed results as real analysis.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The installation command uses npx skills without pinning a specific version, which makes execution dependent on the latest package resolution at install time. This creates a supply-chain risk: a compromised or malicious upstream release could execute arbitrary code on the user's system during installation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements and documents an Amazon review analyzer while the skill manifest advertises a Walmart-specific analyzer. This mismatch can mislead users into trusting Walmart-specific outputs that are actually based on Amazon-oriented assumptions such as ASIN terminology and verified-purchase heuristics, producing incorrect security or fraud assessments.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a Walmart review authenticity analyzer, but the generated report explicitly states 'Generated by Amazon Review Checker'. This is an active documentation/UI contradiction that misrepresents the skill's target platform and intent to users of the generated output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The function writes potentially sensitive review content, analysis metadata, and suspicious-review details directly to an HTML file on disk without any consent prompt, minimization, or privacy warning. In the context of a review-analysis skill, this can expose collected text and derived risk signals to other local users, backups, shared directories, or accidental publication, especially if review content includes personal or confidential information.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The code tells users that reviewer/account profile analysis is available and that supplying reviewer info will unlock it, but no such analysis exists. This is dangerous because users may over-trust the completeness of the fraud assessment and make moderation or purchasing decisions based on a capability that is only claimed, not implemented.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The comment and branching around the output language indicate the skill is designed around English/Chinese only, with a specific forced locale when --zh is present, rather than offering a general user language/locale choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.