T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/query.py:140- Finding
Bundled CLI Exposes Capabilities Beyond the Skill's Declared Scope
- Content
View full analysis
- Remediation
View remediation
Security audit
ecommerce-lead-contacts
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it needs review because a contact-lookup package also exposes broader ecommerce search, analytics, historical revenue/traffic, installed-app, and raw JSON capabilities.
Review this before installing if you only want a narrow contact lookup tool. The skill requires an ECcompass API token and can retrieve contact details as well as broader ecommerce intelligence through the bundled CLI, so use a scoped or disposable token if available, avoid bulk personal-data harvesting, and confirm your use complies with privacy and outreach laws.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query.py:29- Finding
API Credential Can Be Forwarded to a Different Origin During HTTP Redirects
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)
Tainted flow: 'req' from os.environ.get (line 32, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python "Content-Type": "application/json", }) try: with urllib.request.urlopen(req, timeout=30) as resp: return json.loads(resp.read().decode()) except urllib.error.HTTPError as e: raw = e.read().decode() if e.fp else ""
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The metadata presents this as a narrow contact-lookup skill, but the content also advertises broader domain search, analytics, GMV, traffic, plugin, and market-intelligence capabilities through a larger associated skill set. This mismatch can mislead reviewers and operators about the true data-access surface and may cause over-trust or inappropriate deployment in contexts where only limited functionality was expected.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [AI Instructions](SKILL.md) — How the agent uses this skill
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json ], "credentials": { "APEX_TOKEN": { "description": "ECcompass API access token. Sign up at https://eccompass.ai, then go to Dashboard → API Access → Create Token.", "required": true } },
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples document store discovery and domain analytics behavior, while the manifest describes retrieval of decision-maker LinkedIn profiles and business emails. This capability mismatch is dangerous because it obscures the true function of the skill, impairs informed review and consent, and can hide processing of business contact data behind unrelated-looking examples. In a contact-enrichment skill, inconsistent documentation increases the risk of deceptive data handling and misuse of personal/business identity data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script implements broad store discovery, analytics, historical intelligence, and app-enumeration capabilities that materially exceed the manifest's stated purpose of finding LinkedIn profiles and business emails for specific store domains. This capability mismatch increases the chance the skill is used for undisclosed data enrichment or competitive intelligence, violating least privilege and user expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly promotes retrieval of decision-maker LinkedIn profiles and business email addresses, which is personal contact data, but provides no privacy notice, lawful-use guidance, consent expectations, or restrictions on misuse. In an agent skill context, this omission increases the risk that the tool will be used for scraping, unsolicited outreach, profiling, or other privacy-invasive activities without user friction or policy guardrails.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares access to an environment variable and requires network communication, but it does not define explicit tool permissions or allowed-tools scope. That omission weakens least-privilege controls and can allow broader-than-expected execution or exfiltration paths if the runtime grants default capabilities.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example 9: Direct API Call (curl)
bash curl -X POST https://api.eccompass.ai/public/api/v1/search \ -H "APEX_TOKEN: $APEX_TOKEN" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md --- ## 1. Search — `POST https://api.eccompass.ai/public/api/v1/search` ### Request
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Although external transmission is normally expected, this specific endpoint is for retrieving LinkedIn contacts and verified email addresses tied to a company domain. In this skill context, the endpoint materially supports transmission and retrieval of privacy-sensitive personal data from a third party, increasing abuse potential for scraping, profiling, and unsolicited outreach.
- Content
md --- ## 5. LinkedIn Contacts — `GET https://api.eccompass.ai/public/api/v1/contacts/{domain}` ### Request
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The schema explicitly documents an endpoint that returns named LinkedIn contacts with verified email addresses for arbitrary store domains, but provides no privacy, consent, acceptable-use, or abuse-prevention guidance. In the context of a lead-generation skill, this materially enables bulk harvesting of personal contact data for outreach, spam, or profiling, making the exposure more dangerous than a generic business-analytics API.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This concrete request example demonstrates direct retrieval of personal contact records from a third-party service using a domain as input. In a lead-generation skill centered on finding decision-makers and emails, the data flow is more dangerous than a generic external API call because it operationalizes access to sensitive contact data for potential mass outreach or targeting.
- Content
Request
text GET https://api.eccompass.ai/public/api/v1/contacts/ooni.com APEX_TOKEN: <your_token>
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Keyword-based market search enables broad discovery of e-commerce targets unrelated to a user-specified domain, which exceeds the declared purpose of finding contacts for a known store. In context, this makes the skill more dangerous because it supports large-scale prospecting and intelligence gathering rather than narrow, transparent contact lookup.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Historical GMV and traffic retrieval provides competitive and operational intelligence well beyond simple contact lookup. In this skill context, that overreach is meaningful because the manifest primes reviewers and users to expect contact-finding, not detailed commercial analytics on target businesses.
- Content
Static analysis
No suspicious patterns detected.