Universal Product Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:38 AM UTC
• Version: 0.1.0

Overview

The skill is a product-search helper, but it can automatically download and execute a third-party CLI at runtime without a lockfile or explicit user approval.

Review this skill before installing if you do not want agent runs to fetch and execute npm packages automatically. Prefer environments where the approved UCP CLI is preinstalled from a controlled source, with limited filesystem and credential access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/search.mjs:3

Finding

Automatic Retrieval and Execution of an Unverified Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: scripts/search.mjs, lines 3 and 84–93
Vulnerability Type: Supply-chain exposure through automatic package download and execution
Risk Level: Medium

Vulnerable Code

js

const UCP_PACKAGE = "@shopify/ucp-cli@0.6.2";

js

function runUcp(args) {
  const direct = spawnSync("ucp", args, { stdio: "inherit" });
  if (!direct.error || direct.error.code !== "ENOENT") return direct.status ?? 1;

  const npx = process.platform === "win32" ? "npx.cmd" : "npx";
  const fallback = spawnSync(npx, ["--yes", UCP_PACKAGE, ...args], { stdio: "inherit" });
  if (fallback.error) fail(`Unable to run Shopify UCP CLI: ${fallback.error.message}`);
  return fallback.status ?? 1;
}

Technical Analysis

When a local ucp executable cannot be found, the wrapper automatically invokes npx --yes @shopify/ucp-cli@0.6.2. This causes code outside the reviewed project to be retrieved from the configured package registry and executed without an interactive confirmation step.

Pinning the package to version 0.6.2 reduces exposure to unexpected version changes, but the project does not include a lockfile, package integrity hash, vendored package, or other mechanism that independently verifies the downloaded artifact and its transitive dependencies. The executed payload therefore depends on external registry and package-account integrity at invocation time.

This behavior is documented indirectly as a UCP CLI wrapper and is not evidence that the named package is currently malicious. Nevertheless, automatic retrieval and execution creates a supply-chain trust boundary that cannot be fully audited from the submitted files.

The process invocation uses an argument array without enabling a shell, so the reviewed code does not demonstrate shell-command injection through user-supplied search parameters.

Attack Path

1. A user or agent invokes scripts/search.mjs for product search or profile initialization.
2. The wrappe ...[truncated 1305 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic npx --yes fallback and fail safely when the required CLI is not installed.
2. Require administrators or users to install an explicitly approved UCP CLI package before invoking the skill.
3. Declare the CLI in a package manifest and commit a lockfile containing resolved versions and integrity metadata.
4. Install dependencies in a controlled build or deployment stage using lockfile-enforcing options such as npm ci.
5. Verify package provenance, signatures, and integrity where supported by the package distribution system.
6. Consider vendoring or internally mirroring the reviewed dependency and its transitive dependency graph.
7. Execute the CLI in a sandbox with minimal filesystem, environment-variable, credential, and network access.
8. If runtime retrieval is unavoidable, require explicit user approval and restrict downloads to a trusted registry configured with integrity and provenance controls.
9. Regularly scan and re-audit the pinned package and all transitive dependencies for known vulnerabilities and ownership changes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

rchant catalog through the Universal Commerce Protocol (UCP) using the bundled `scripts/search.mjs` wrapper. Keep this skill focused on discovery: do not create

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description is broadly phrased enough to activate on a wide range of generic shopping or research requests, which can cause the agent to invoke this skill in situations where a more specific or safer skill would be more appropriate. Over-broad routing increases the chance of unintended data flow to the search wrapper and can expand the skill’s operational scope beyond what the user clearly intended.

Content

No source excerpt is available for this finding.