ClawHub
Back to skill

Security audit

VIA Commerce

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed VIA commerce integration that can search sellers and guide transactions, with payment gated on explicit user approval.

Install only if you want your agent to use VIA for commerce. Be careful with wallet details, dashboard passwords, seller MCP connections, and USDC payment delegation; require the agent to show prices/options and get your explicit approval before any purchase.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill uses very broad trigger phrases such as "buy X", "source X", and "what's available on VIA", which can cause the agent to invoke this commerce workflow for ordinary shopping-related conversation without sufficiently confirming user intent. In a skill that can discover sellers and later facilitate purchases, unintended activation increases the risk of unnecessary external network access, premature transactional guidance, or steering the user into a payment-capable flow.

Static analysis

No suspicious patterns detected.