ClawHub
Back to skill

Security audit

Shopware Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Shopware documentation skill with clear scope, though users should treat its installer and API command examples carefully.

Install only if you want an agent to help with Shopware development or operations. Keep tool allowlists narrow, use staging for risky changes, do not paste secrets into chat, and do not let the agent run installer snippets such as curl piped to sh or sudo unless you have independently verified the source and understand the local changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/INSTALLATION_AND_HOSTING_PART3.md:313
Finding

Unverified Remote Nix Installer Executed Directly by a Shell

Content
View full analysis

Vulnerability Details

File Location: references/INSTALLATION_AND_HOSTING_PART3.md:313
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash
curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install

Technical Analysis

This command pipes a mutable HTTP response directly into sh. Although HTTPS and TLS restrictions protect the connection against straightforward network interception, they do not establish that the downloaded script is immutable, expected, or independently authenticated.

The effective payload can change after the Skill has been reviewed. Compromise of the installer service, its hosting infrastructure, DNS, release process, or signing credentials could therefore result in arbitrary shell commands being returned and executed. The user has no opportunity to inspect the script before execution, and the command does not verify a vendor signature or a pinned cryptographic digest.

This exceeds the minimum privileges necessary to explain Shopware development-environment installation. The same task can be completed by downloading a version-pinned installer, verifying it, and requesting explicit authorization before running it.

Attack Path

  1. A user or Agent loads the Shopware hosting documentation and follows the Nix installation instructions.
  2. An attacker compromises the remote installer endpoint or an upstream component controlling its response.
  3. The endpoint returns a modified shell script containing attacker-selected commands.
  4. curl streams that content directly to sh.
  5. The commands execute with the privileges of the invoking account.
  6. If the user subsequently supplies elevated credentials, the installer may also obtain system-level privileges.

Impact Assessment

Successful exploitation provides arbitrary command execution as the invoking user. This may p ...[truncated 416 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sh instruction.
  • Download the installer to a non-executable temporary file using a version-pinned URL.
  • Verify a vendor signature or a published SHA-256 digest obtained through an independent authenticated channel.
  • Display or inspect the downloaded script before execution.
  • Run the installer only after explicit user approval and under a minimally privileged account.
  • Prefer an operating-system package manager or another distribution mechanism with signed metadata.
  • Pin the installer version rather than relying on mutable latest content.
  • Document expected filesystem, profile, service, and privilege changes before installation.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:171
Finding

Shopware PaaS CLI Installer Is Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:171-179
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

sh
curl -L https://install.sw-paas-cli.shopware.systems | sh
sh
curl -L https://install.sw-paas-cli.shopware.systems | sh -s 0.0.30

Technical Analysis

Both commands execute the response from a remote installer service directly in a shell. The first retrieves mutable latest content. The second supplies a nominal CLI version to the installer, but neither the installer script nor the resulting binary is authenticated with a signature or cryptographic checksum.

Passing 0.0.30 does not secure the operation because the mutable installer script executes before it processes that argument. A compromised endpoint can ignore the requested version and run arbitrary commands. Redirect following with -L also means execution can continue from a different final location without an explicit host allowlist.

This behavior is especially sensitive because the installed CLI is subsequently used for Shopware PaaS authentication and stores an authentication token automatically. Installer compromise can therefore precede and capture valuable cloud credentials.

Attack Path

  1. A user or Agent follows the PaaS CLI installation guide.
  2. An attacker compromises the installer endpoint, its redirect destination, or its release-delivery chain.
  3. The endpoint returns a malicious shell script.
  4. The script is streamed directly to sh and executes as the current user.
  5. The payload modifies or replaces the expected sw-paas binary, changes shell startup configuration, or installs a credential-harvesting wrapper.
  6. The user runs sw-paas auth.
  7. The malicious installer or replacement binary captures the resulting Shopware PaaS token or performs unauthorized operations.

Impact Assessment

...[truncated 427 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace both pipe-to-shell examples with a verified installation workflow.
  • Prefer a trusted package manager with signed repository metadata when available.
  • Otherwise, download a specific CLI release separately from an official, version-pinned location.
  • Verify a vendor signature or independently published cryptographic checksum before execution.
  • Verify both the installer and final CLI binary; pinning only the CLI argument is insufficient.
  • Do not modify PATH or shell profile files automatically without explicit approval.
  • Install into a user-controlled, dedicated directory with minimal permissions.
  • Display the final redirect URL and reject redirects to hosts outside an explicit official allowlist.
  • Run sw-paas auth only after validating the binary provenance and integrity.

T03 · Remote Payload Retrieval and Execution

Error
Location
references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:360
Finding

Quickstart Repeats Unverified Shopware PaaS CLI Remote Execution

Content
View full analysis

Vulnerability Details

File Location: references/PRODUCT_EXTENSIONS_OVERVIEW_PART6.md:360
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

sh
curl -L https://install.sw-paas-cli.shopware.systems | sh

Technical Analysis

The PaaS quickstart independently repeats the unsafe installation pattern. It retrieves a mutable script, follows redirects, and sends the response directly to a shell without a version pin, checksum, signature, or inspection step.

Because this command appears in a quickstart workflow, users or automation Agents are particularly likely to execute it without further review. The documentation context does not constrain what the remote endpoint can return or limit the privileges available to the resulting script.

Attack Path

  1. A user or Agent selects the PaaS quickstart workflow.
  2. The installer endpoint or its delivery infrastructure is compromised.
  3. A malicious response is returned, potentially through an HTTP redirect.
  4. The response executes immediately through sh.
  5. The payload compromises local files or installs a spoofed sw-paas executable.
  6. Later repository, vault, deployment, or authentication commands expose credentials or permit unauthorized cloud operations.

Impact Assessment

The attacker obtains command execution with the invoking user's privileges. The reachable scope can include local Shopware projects, Git credentials, deployment SSH material, shell configuration, and later PaaS authentication tokens. A spoofed CLI may also perform unauthorized actions within every Shopware organization or project available to the authenticated identity.

Remediation
View remediation

Remediation Suggestions

  • Remove the duplicated pipe-to-shell quickstart command.
  • Link to a hardened installation section rather than repeating an unsafe abbreviated workflow.
  • Require a pinned release, signature or checksum verification, and explicit approval before execution.
  • Validate redirect destinations against an official host allowlist.
  • Recommend execution under an unprivileged account in a sandboxed environment.
  • Include post-installation integrity verification before authentication, vault, repository, or deployment commands are used.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (596)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/PRODUCT_EXTENSIONS_OVERVIEW_PART5.md (reported line 165)May include surrounding context.

-id>][subscriptionPlan]" value=""

Weekly interval Monthly interval Yearly interval ```
sh
curl -XPOST '/store-api/checkout/cart/line-item' -d '{
    "lineItems": [{
      "id": <product-id>,
      "subscriptionPlan": <subscription-plan-id>,
      "subscriptionInterval": <subscription-interval-id>
      ...
    }]
  }'

Events

A mixed cart will fire all events like usual. Additionally, any event fired during the subscription cart calculation will be prefixed with subscription. like it is the case in the separate checkout.

:::info Note that unlike the separate checkout, only the normal CheckoutOrderPlacedEvent but no `'subscription.' . Ch

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
backward compatibility, Storefront / Store API conventions). Longer excerpts: `TESTING_AND_QUALITY_PART2.md` (search `resources/guidelines`).

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
AMPLES_PLUGIN_DAL.md`**, **`SHOPWARE_67_EXAMPLES_STOREFRONT_ADMIN_CMS.md`**, **`SHOPWARE_67_PRACTICAL_NOTES.md`**, **`ADMIN_API.md`**, **`STORE_API.md`**, **`PL

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
7_EXAMPLES_STOREFRONT_ADMIN_CMS.md`**, **`SHOPWARE_67_PRACTICAL_NOTES.md`**, **`ADMIN_API.md`**, **`STORE_API.md`**, **`PLUGIN_SYSTEM.md`**, **`APP_SYSTEM.md`**

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
NOTES.md`**, **`ADMIN_API.md`**, **`STORE_API.md`**, **`PLUGIN_SYSTEM.md`**, **`APP_SYSTEM.md`**, **`HEADLESS_FRONTENDS.md`**, **`INSTALLATION_AND_HOSTING.md`**

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ADMINISTRATION_UI.md (reported line 795)May include surrounding context.

md
<label lang="de-DE">Modul im Adminmenü</label>
        </module>

        <!-- You can use the same url to open your module from the app store -->
        <main-module source="https://example.com/main"/>
    </admin>
</manifest>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ADMINISTRATION_UI_PART2.md (reported line 483)May include surrounding context.

In this very simple example it suffices to create a twig file, declare a block with the name we previously found and to insert our new header into the block.

text
<!-- <plugin root>/src/Resources/app/administration/src/sw-dashboard-index-override/sw-dashboard-index.html.twig -->
{% block sw_dashboard_index_content_intro_content_headline %}
    <h1>
        Welcome to a customized component

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ADMINISTRATION_UI_PART3.md (reported line 797)May include surrounding context.

md
{% parent %}

    <!-- We'll define a custom route here, an explanation will follow later -->
    <sw-tabs-item :route="{ name: 'sw.product.detail.custom', params: { id: $route.params.id } }" title="Custom">
        Custom
    </sw-tabs-item>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ADMIN_EXTENSION_SDK.md (reported line 960)May include surrounding context.

md
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/shopware/platform/trunk/src/Core/Framework/App/Manifest/Schema/manifest-1.0.xsd">

    <!-- ... -->

    <permissions>
        <create>product</create>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/APP_SYSTEM.md (reported line 121)May include surrounding context.

text

By default, your app files will be [validated](app-base-guide#validation) before installation.
To skip the validation, you may use the `--no-validate` flag.

::: info
Without the `--activate` flag the Apps get installed as inactive.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM.md (reported line 177)May include surrounding context.

md
...
    </meta>
    <setup>
        <!-- The URL which will be used for the registration -->
        <registrationUrl>https://my.example.com/registration</registrationUrl>
        <!-- Dev only, the secret that is used to sign the registration request -->
        <secret>mysecret</secret>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM.md (reported line 2863)May include surrounding context.

md
<!-- A unique technical name for your block. We recommend to use a shorthand prefix for your company, e.g. "Swag" for shopware AG. -->
            <name>swag-image-text-reversed</name>

            <!-- The category your block is associated with. See the XSD for available categories. -->
            <category>text-image</category>

            <!-- Your block's label which will be shown in the CMS module in the Administration. -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 596)May include surrounding context.

xml
<?xml version="1.0" encoding="UTF-8"?>
<manifest>
    <!-- ... -->

    <gateways>
        <checkout>https://my-app.server.com/checkout/gateway</checkout>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 904)May include surrounding context.

md
<!-- ... -->

    <gateways>
        <!-- ... -->
        <context>https://my-app.server.com/context/gateway</context>
    </gateways>
</manifest>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 1629)May include surrounding context.

md
}
        </script>

        <!-- ... -->
    </head>

    <!-- ... -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 1691)May include surrounding context.

vue
<template>
    <!-- ... -->
    <p>
        If you buy this you'll get an incredible useful feature: ...
    </p>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 1752)May include surrounding context.

md
}
        </script>

        <!-- ... -->
    </head>

    <!-- ... -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 2081)May include surrounding context.

md
<meta>
        <!-- The name of the app should not change. Otherwise, all payment methods are created as duplicates. -->
        <name>PaymentApp</name>
        <!-- ... -->
    </meta>

    <payments>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 2374)May include surrounding context.

md
</meta>
    <rule-conditions>
        <rule-condition>
            <!-- The identifier of the rule condition must be unique should not change. Otherwise a separate rule condition is created and uses of the old one are lost. -->
            <identifier>my_custom_condition</identifier>
            <!-- Translatable, a name of your rule condition -->
            <name>Custom condition</name>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/APP_SYSTEM_PART2.md (reported line 2546)May include surrounding context.

misc

text

```twig

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/APP_SYSTEM_PART3.md (reported line 61)May include surrounding context.

Also, configure the DATABASE_URL to point to your database:

sh
// .env
....

###> shopware/app-bundle ###

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CONCEPTS_ARCHITECTURE.md (reported line 1095)May include surrounding context.

Also, configure the DATABASE_URL to point to your database:

sh
// .env
....

###> shopware/app-bundle ###

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/HEADLESS_FRONTENDS_PART2.md (reported line 4483)May include surrounding context.

Also, configure the DATABASE_URL to point to your database:

sh
// .env
....

###> shopware/app-bundle ###

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/INSTALLATION_AND_HOSTING.md (reported line 796)May include surrounding context.

Also, configure the DATABASE_URL to point to your database:

sh
// .env
....

###> shopware/app-bundle ###

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/INSTALLATION_AND_HOSTING.md (reported line 808)May include surrounding context.

Also, configure the DATABASE_URL to point to your database:

sh
// .env
....

###> shopware/app-bundle ###

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/HEADLESS_FRONTENDS_PART2.md:1456

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/HEADLESS_FRONTENDS.md:3678