Buy Me a Pie

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its shopping-list purpose, but it can send reusable Buy Me a Pie credentials to an arbitrary API URL if misused.

Review before installing. Use only protected environment variables for BUYMEAPIE_LOGIN and BUYMEAPIE_PIN, avoid passing the PIN on the command line, and do not use --base-url unless you have verified it is the real HTTPS Buy Me a Pie API endpoint. The skill can read, create, update, share, and delete shopping-list data under the configured account.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/buymeapie_api.py:156

Finding

Arbitrary API base URL can disclose reusable account credentials

Content

View full analysis

Any: url = f"{self.base_url}{path}" if params: query = urllib.parse.urlencode(params) url = f"{url}?{query}" body = None headers = dict(self.headers) if payload is not None: body = json.dumps(payload).encode("utf-8") headers["Content-Type"] = "application/json" request = urllib.request.Request(url, data=body, headers=headers, method=method.upper()) try: with urllib.request.urlopen(request, timeout=self.timeout) as response: return parse_json(response.read()) ``` ```python parser.add_argument("--login", default=os.getenv("BUYMEAPIE_LOGIN"), help="Buy Me a Pie login") parser.add_argument("--pin", default=os.getenv("BUYMEAPIE_PIN"), help="Buy Me a Pie PIN") parser.add_argument("--base-url", default=DEFAULT_BASE_URL, help="API base URL") parser.add_argument("--timeout", type=int, default=15, help="HTTP timeout in seconds") ``` ```python client = BuyMeAPieClient(login=login, pin=pin, base_url=args.base_url, tim ...[truncated 2327 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/buymeapie_api.py:156

Finding

PIN accepted through command-line arguments can leak through local process metadata

Content

View full analysis

tuple[str, str]: if not args.login or not args.pin: raise ApiError(0, "Missing credentials. Set BUYMEAPIE_LOGIN and BUYMEAPIE_PIN or pass --login/--pin.") return args.login, args.pin ``` ### Technical Analysis The command interface accepts the account PIN directly through `--pin`, and the error message explicitly recommends this mechanism. Command-line secrets can be retained or exposed through: - Shell history. - Process listings and process inspection interfaces. - Job schedulers and process supervisors. - Terminal session recording. - Audit, debugging, and observability systems. - Agent execution logs that record complete commands. Unlike an interactive no-echo prompt or a protected secret provider, a command-line argument is commonly treated as ordinary process metadata. The Skill only needs access to the credential for authentication; exposing it through process arguments is unnecessary. ### Attack Path 1. A user or agent invokes the client with a command such as: ```sh scripts/buymeapie.sh --login [e-mail] --pin 1234 lists ``` 2. The complete command is stored in shell history, agent logs, scheduler configuration, or process-monitoring output. 3. A local user, administrator, monitoring operator, or party with access to retained logs reads the PIN. 4. The observer combines the PIN with the login shown in the same command. 5. The observer authenticates to the Buy Me a Pie API and performs actions allowed by the account. ...[truncated 349 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 42)May include surrounding context.

md

- Update list metadata.
  - Payload used by frontend: `{"name","emails"}`
  - Sharing is implemented by replacing the `emails` array on this endpoint.
- `DELETE /lists/{list_id}`
  - Delete list.

### Items

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 58)May include surrounding context.

md

- `PUT /lists/{list_id}/items/{item_id}`
  - Partial item update.
  - Payload can contain any subset of `title`, `amount`, `is_purchased`.
- `DELETE /lists/{list_id}/items/{item_id}`
  - Delete item.

### Unique items

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 67)May include surrounding context.

md

- Returns the autocomplete dictionary.
- `PUT /unique_items/{encoded_title}`
  - Payload: `{"group_id","permanent","use_count"}`
- `DELETE /unique_items/{encoded_title}`
- `DELETE /unique_items/permanent/{encoded_title}`

## Endpoints to avoid in v1

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 68)May include surrounding context.

md

- `PUT /unique_items/{encoded_title}`
  - Payload: `{"group_id","permanent","use_count"}`
- `DELETE /unique_items/{encoded_title}`
- `DELETE /unique_items/permanent/{encoded_title}`

## Endpoints to avoid in v1

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires environment variables containing account credentials and is designed to make networked API calls, but it declares no explicit tool scope or permission boundaries. This increases the chance that an agent runtime grants broader-than-necessary access or that users invoke the skill without understanding it can read secrets and send data off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to provide sensitive credentials (BUYMEAPIE_LOGIN and BUYMEAPIE_PIN) without warning that these secrets must be protected from logs, prompts, screenshots, shell history, or unintended disclosure to other tools. In a skill that performs API operations against a third-party account, mishandling these credentials could allow unauthorized access or modification of shopping lists and account-related actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document specifies that long-lived account credentials are handled via HTTP Basic Auth and stored in a cookie, but it does not warn that the login:PIN pair is effectively the full account secret. In a third-party skill context, documenting this pattern without clear handling constraints increases the chance the implementation will persist, log, or expose reusable credentials, leading to account compromise if mishandled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code hard-codes the Accept-Language header to en, which imposes a specific language preference for every request. This is a natural-language policy concern because the user is not offered a locale choice and the file does not document a region-specific reason for forcing English.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a manifest file, so vague-trigger review applies. The manifest provides summary, tags, and entrypoint information but no explicit trigger phrases, scope limits, or exclusion conditions, making invocation boundaries unclear and increasing the chance of unintended activation by a host system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 2% confidence

Finding

Reviewed for natural-language policy violations such as forced language or locale constraints. The manifest contains no language or locale restriction, so this does not constitute a policy violation.

Content

No source excerpt is available for this finding.