ClawHub
Back to skill

Security audit

Swiggy

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Swiggy ordering purpose, but its CLI unsafely builds shell commands from user-controlled input and needs review before installation.

Review before installing or using. Do not pass untrusted or copied text into the swiggy CLI until the command construction is fixed to use an argument-array API such as execFileSync/spawnSync with shell disabled. Also confirm that you are comfortable sending Swiggy searches, locations, addresses, cart contents, and booking/order details to Swiggy MCP servers and using a compatible patched Clawdbot version.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
swiggy-cli.js:18
Finding

Shell Command Injection Through User-Controlled CLI Arguments

Content
View full analysis

Vulnerability Details

File Location: swiggy-cli.js, lines 18–28
Vulnerability Type: OS command injection caused by unsafe shell command construction
Risk Level: High

Vulnerable Code

js
function exec(cmd) {
  try {
    return execSync(cmd, { encoding: 'utf8', stdio: 'pipe' });
  } catch (err) {
    console.error('Error:', err.message);
    if (err.stderr) console.error(err.stderr);
    process.exit(1);
  }
}

function callMCP(server, tool, args = {}) {
  const argsJson = JSON.stringify(args);
  const cmd = `mcporter call --server "${MCP_SERVERS[server]}" --tool "${tool}" --args '${argsJson}'`;
  return exec(cmd);
}

Technical Analysis

callMCP() serializes MCP arguments as JSON and embeds the resulting string inside a shell command enclosed by single quotes. It then passes the command string to execSync(), which executes it through a shell.

JSON serialization is not shell escaping. In particular, JSON.stringify() does not escape shell single quotes. A single quote in any attacker-controlled MCP argument can terminate the quoted --args value. The attacker can then append shell operators and arbitrary commands.

Multiple CLI inputs flow into this sink, including search queries, locations, delivery addresses, item and restaurant identifiers, dates, and times. The vulnerability is therefore reachable through non-transactional operations such as restaurant searches and does not require bypassing the --confirm order safeguard.

Attack Path

  1. An attacker supplies a crafted value through a forwarded CLI argument, such as a restaurant search query.
  2. The CLI includes that value in the MCP argument object.
  3. JSON.stringify() produces valid JSON but leaves the shell-relevant single quote intact.
  4. callMCP() places the JSON inside a single-quoted shell command.
  5. The crafted quote closes the --args shell argument.
  6. Shell syntax following the quote is ...[truncated 1188 chars]
Remediation
View remediation

Remediation Suggestions

Eliminate shell command construction entirely. Invoke mcporter with an argument array and explicitly disable shell processing:

js
const { execFileSync } = require('child_process');

function callMCP(server, tool, args = {}) {
  return execFileSync('mcporter', [
    'call',
    '--server', MCP_SERVERS[server],
    '--tool', tool,
    '--args', JSON.stringify(args)
  ], {
    encoding: 'utf8',
    stdio: 'pipe',
    shell: false
  });
}

Apply the following additional hardening:

  1. Validate structured identifiers against strict allowlists, such as expected character sets and maximum lengths.
  2. Validate quantities and guest counts as bounded positive integers and reject NaN, zero, negative, or excessive values.
  3. Validate dates and times using strict parsers rather than forwarding arbitrary strings.
  4. Limit the length of free-form queries, locations, and addresses.
  5. Do not attempt to fix this solely with manual shell escaping; argument-array APIs are safer and less error-prone.
  6. Add regression tests using apostrophes, quotes, command substitutions, semicolons, newlines, pipes, redirections, and other shell metacharacters.
  7. Run the CLI with the minimum filesystem and credential access required for its intended function.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest configures three external MCP servers over HTTP transport endpoints, which means user prompts, account-linked data, order details, and location-related information may be transmitted to third-party infrastructure. Even though the URLs use HTTPS, the package metadata shown here provides no user-facing disclosure or consent mechanism about this data flow, which is a meaningful privacy and trust issue for a commerce skill handling sensitive transactional data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
63% confidence
Finding

The natural-language description says the skill is for ordering food, groceries, and booking restaurants 'in India', which imposes a locale constraint in user-facing text. The file does not explicitly present this as an optional region selection or provide additional justification beyond the terse description.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

Using an unpinned peer dependency of "clawdbot": "*" allows installation with any version of the host framework, including future releases with breaking security changes or known vulnerable versions. In a skill that brokers food orders and potentially handles personal, address, and payment-adjacent workflows, relying on an unconstrained host version increases supply-chain and compatibility risk.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
"license": "MIT",
  "dependencies": {},
  "peerDependencies": {
    "clawdbot": "*"
  },
  "engines": {
    "node": ">=18.0.0"

Unverifiable Dependency: clawdbot has 11 known advisory(ies) (CVE-2026-26317 (OpenClaw affected by cross-site request forgery (CSRF) through loopback browser ); GHSA-chm2-m3w2-wcxm (OpenClaw Google Chat spoofing access with allowlist authorized mutable email pri); CVE-2026-26328 (OpenClaw iMessage group allowlist authorization inherited DM pairing-store ident) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest depends on clawdbot without pinning a version, while the analysis indicates multiple known advisories affecting some releases of that dependency. Because the version is unconstrained, consumers may install a vulnerable host version, and this skill's use of remote MCP servers and transactional flows could amplify the consequences of host-level spoofing, authorization, or CSRF issues.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
swiggy-cli.js:21