ClawHub
Back to skill

Security audit

Food402 - TGO Yemek

Security checks across malware telemetry and agentic risk

Overview

This food-ordering skill is mostly aligned with its purpose, but it handles account login, saved-card checkout, and 3D Secure payment data with weak local safeguards that deserve review before installation.

Install only if you are comfortable giving this skill access to your TGO account, saved delivery addresses, basket, order history, and saved-card checkout flow. Use it on a single-user trusted machine, verify the restaurant, address, basket, total, and card before any order, and avoid providing a Google Places API key unless you want review lookup. The safest improvement would be private token storage and a tighter 3D Secure flow that does not open raw temporary HTML without clear origin validation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes shell commands extensively (`curl`, `jq`, helper scripts) while declaring no permissions, which hides its true execution capabilities from the platform and reviewer. This weakens least-privilege controls and can cause users or orchestration layers to authorize a skill without understanding that it can execute local commands and access sensitive environment-backed credentials.

Description-Behavior Mismatch

Low
Confidence
82% confidence
Finding
The skill description says it is for ordering food from TGO Yemek, but the implementation can also call Google Places using a separate API key to retrieve reviews. This is a transparency and data-flow issue: users and reviewers may not realize the skill contacts an additional third party, which affects consent, privacy expectations, and supply-chain review.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script writes full 3D Secure HTML content to a predictable file in /tmp, which can expose sensitive payment or session data to other local processes or users depending on system configuration and browser behavior. In a payment-handling skill, persisting authentication pages to disk increases the risk of credential, token, or personal data leakage beyond the intended browser session.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script writes the bearer token to a predictable path in /tmp without setting restrictive permissions or using a secure temporary file primitive. On multi-user systems or unsafe tmp configurations, another local user or process could read, replace, or race this file and hijack the authenticated session.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.