Security audit

ecommerce-ops-assistant

Security checks for vulnerabilities and agentic risk

Overview

The e-commerce assistant is not clearly malicious, but it should be reviewed because it adds automatic local memory and self-modification behavior without clear user control.

Review before installing. This skill appears aimed at e-commerce operations and I found no evidence of exfiltration, destructive behavior, or obfuscation, but it can record local usage history, errors, notes, and preferences, and it instructs the agent to adapt or modify its own skill instructions. Install only if you are comfortable with that local persistence, or remove/disable the learner and self-editing instructions first.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as an e-commerce operations assistant, but the documentation also instructs it to maintain persistent local memory, track usage, store user preferences, and modify its own skill materials. That materially expands behavior beyond the declared business function and can surprise users, creating privacy, integrity, and scope-creep risks.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The added self-learning system introduces cross-session memory and adaptive behavior unrelated to the core e-commerce assistant scope. Persistent memory changes the trust model because future responses may be influenced by retained data that users did not expect to be stored.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Persisting user preferences and error history can collect behavioral data over time, potentially including sensitive business context, without a clear need for the advertised functionality. This creates privacy and profiling risk, especially in a public skill handling merchant operations data.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The module is explicitly designed as a generic cross-skill learning component for any WorkBuddy skill, which exceeds the narrowly described ecommerce-operations purpose in the manifest. This broader capability increases the attack surface by enabling persistent telemetry and reuse across unrelated skills, creating scope creep and potential unauthorized data collection.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code persistently stores usage history, error history, free-form notes, and user preferences in learned_patterns.json without any demonstrated necessity tied to the ecommerce assistant's stated purpose. If notes or preferences contain sensitive business or personal data, this creates privacy and data-retention risk through unnecessary local persistence.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Broad trigger phrases increase the chance that the skill activates on loosely related conversations, which can expose users to unintended tool use, web access, or persistence features. In a public skill with write and fetch capabilities, accidental invocation increases the attack surface.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation says the skill will automatically write memory files and even write back to `SKILL.md`, but it does not clearly warn users or ask permission. Silent persistence and self-modification undermine user trust and can create privacy, integrity, and tampering risks.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script writes a persistent JSON file containing notes and preferences, but its CLI messages and help text do not warn users that their inputs will be stored on disk. This lack of transparency can lead users to provide sensitive information under the false assumption that it is ephemeral, increasing privacy and compliance risk.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Natural-language instructions to persist usage history and preferences across sessions establish a durable memory store that may accumulate sensitive merchant, behavioral, or operational data. Because this is local cross-session state, it can be reused, exposed, or manipulated later in ways users did not authorize.

Static analysis

No suspicious patterns detected.