Security audit

Shopify Link Checkout

Security checks for vulnerabilities and agentic risk

Overview

This skill is for real autonomous purchases and exposes payment and personal data in ways that need careful human review before use.

Only install this after treating it as a high-risk spending automation tool. Do not provide live card or personal data unless the checkout destination is independently verified, dependencies are pinned and installed safely, browser sandboxing is restored or isolated, and a human approval step checks the exact merchant, item, total, shipping address, and payment method immediately before payment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/shopify-checkout.mjs:43
Finding: Unvalidated Checkout Destination Can Receive Payment Card Data and Buyer PII
Content: View full analysis
{ const frame = page.frames().find(f => f.url().includes(urlPart)); if (frame) { await frame.fill(selector, value); return true; } return false; }; await fillFrame('number-ltr', '#number', cardNumber); await fillFrame('name-ltr', '#name', BUYER.cardName); await fillFrame('expiry-ltr', '#expiry', cardExp); await fillFrame('verification_value-ltr', '#verification_value', cardCvc); ``` ### Technical Analysis The checkout destination is derived directly from the caller-controlled `storeDomain`. The implementation does not parse and validate ...[truncated 2712 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/shopify-checkout.mjs:43
Finding: Payment Card Data and Buyer PII Are Exposed Through Command-Line Arguments
Content: View full analysis
\ --email --first --last \ --address "" --apt "" --city "" --state --zip \ --phone ``` The script reads these values directly from `process.argv`: ```javascript const args = process.argv.slice(2); const positional = []; const opts = {}; for (let i = 0; i < args.length; i++) { if (args[i].startsWith('--') && i + 1 < args.length) { opts[args[i].replace('--', '')] = args[++i]; } else { positional.push(args[i]); } } const [storeDomain, variantId, cardNumber, cardExp, cardCvc] = positional; ``` The usage documentation also supplies a realistic-looking example containing all relevant data classes: ```javascript * Example: * node shopify-checkout.mjs krink.com 943039957 4866560007880691 04/29 850 \ * --email me@example.com --first Stephen --last Liriano \ * --address "11 Plaza Real S" --apt "Apt 218" \ * --city "Boca Raton" --state FL --zip 33432 --phone 4843325580 ``` ### Technical Analysis Operating systems commonly expose process arguments through process listings, diagnostic interfaces, audit frameworks, endpoint monitoring products, container metadata, and orchestration telemetry. Commands entered interactively may also be retained in shell history. Consequently, passing a primary account number, expiration date, CVC, email, phone number, and physical address through `argv` creates multiple plaintext copies outside the browser automation process. These copies can persist longer than the intended one-time payment-card lifetime and may be access ...[truncated 1428 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/chromium-deps.md:19
Finding: Chromium Libraries Are Downloaded Without Transport Security or Integrity Verification
Content: View full analysis
/dev/null done ``` The extracted libraries are then prioritized for dynamic loading: ```bash export LD_LIBRARY_PATH="$HOME/.local/lib/chromium-deps/usr/lib/x86_64-linux-gnu:$HOME/.local/lib/chromium-deps/lib/x86_64-linux-gnu" ` ...[truncated 2104 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/shopify-checkout.mjs:83
Finding: Unpinned Runtime Dependencies Are Combined with Disabled Chromium Sandboxing
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is scoped to autonomous purchasing and uses very broad activation phrases such as general shopping requests. In an agent environment, this can cause the skill to trigger for ambiguous user intent and escalate directly into product search, payment approval flows, and browser-driven checkout, increasing the risk of unintended purchases or unauthorized transactional actions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
node scripts/shopify-checkout.mjs <store-domain> <variant-id> <card-number> <MM/YY> <cvc> \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
node scripts/shopify-checkout.mjs <store-domain> <variant-id> <card-number> <MM/YY> <cvc> \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
node scripts/shopify-checkout.mjs <store-domain> <variant-id> <card-number> <MM/YY> <cvc> \

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and header describe Stripe Link-based purchasing, but the script actually ingests raw PAN, expiry, and CVC from CLI arguments and injects them into Shopify card iframes. That mismatch is dangerous because it expands PCI scope, enables direct handling of highly sensitive payment data, and can mislead users or orchestrators into granting the skill broader trust than its implementation deserves.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script performs the irreversible 'Pay now' click immediately once fields are populated, with no final confirmation gate, preview, or explicit user re-authorization. In the context of an autonomous shopping skill, this materially increases the risk of accidental purchases, manipulated orders, wrong item/shipping selection, or abuse by upstream prompts and agents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
Option A — Catalog API (search across all Shopify merchants):

bash
# Get auth token (60min TTL) TOKEN=$(curl -s -X POST https://api.shopify.com/auth/access_token \ -H 'Content-Type: application/json' \ -d '{"client_id":"'$CLIENT_ID'","client_secret":"'$CLIENT_SECRET'","grant_type":"client_credentials"}' \ | jq -r .access_token)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
Option A — Catalog API (search across all Shopify merchants):

bash
# Get auth token (60min TTL) TOKEN=$(curl -s -X POST https://api.shopify.com/auth/access_token \ -H 'Content-Type: application/json' \ -d '{"client_id":"'$CLIENT_ID'","client_secret":"'$CLIENT_SECRET'","grant_type":"client_credentials"}' \ | jq -r .access_token)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This skill sends user shopping queries and purchase-related metadata to an external catalog service covering all Shopify merchants. In context, the skill is designed for autonomous purchasing, so external transmission is expected, but the documentation does not require explicit user consent, data minimization, or constraints on what may be sent, creating privacy and unintended-disclosure risk if user-provided requests include sensitive personal information.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
| jq -r .access_token) # Search curl -s -X POST https://catalog.shopify.com/api/ucp/mcp \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d '{

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The catalog search example fixes shipping to {"country":"US"}, which imposes a locale-specific behavior. The file does not indicate that this is optional, user-selected, or required for a region-specific use case, so it appears to force a locale without opt-in.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/chromium-deps.md (reported line 17)May include surrounding context.
Install Process

bash
mkdir -p /tmp/cdeps ~/.local/lib/chromium-deps cd /tmp/cdeps BASE="http://deb.debian.org/debian/pool/main"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The install instructions download Debian packages over plain HTTP from deb.debian.org and security.debian.org, then immediately extract them into a user-controlled library path without any integrity verification. This creates a man-in-the-middle and supply-chain risk where a network attacker could replace libraries consumed by Chromium, potentially leading to arbitrary code execution in the user's environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly recommends anti-detection Chromium flags such as disabling AutomationControlled and using no-sandbox settings, which are not required just to run Shopify checkout. In a purchasing automation skill, these settings facilitate stealthy browser impersonation and reduce platform defenses, increasing the risk of policy evasion, fraud, and abuse against merchants or payment flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document instructs users to configure a 'realistic user agent' specifically to make automation appear human-driven, without any transparency, consent, or policy rationale. In the context of autonomous purchasing and checkout, this is deceptive behavior that can be used to bypass bot controls, transaction monitoring, or merchant restrictions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The explicit claim that the cart permalink flow 'bypasses Cloudflare' signals intent to evade anti-bot or anti-abuse protections rather than simply automate a normal checkout. In a purchasing automation skill, anti-protection logic increases the risk of unauthorized transactions, abuse against merchants, and operation outside expected platform controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script suppresses automation indicators, sends Escape to dismiss friction, and directly removes modal elements from the DOM. Those behaviors go beyond accessibility or reliability handling and instead attempt to defeat merchant checkout controls such as login prompts, Shop Pay interstitials, or anti-automation friction, making unauthorized or policy-violating purchases easier.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T08 · Insecure Dependencies

SkillSpector

Vague Triggers

Ae1

Ae1

Ae1

Intent-Code Divergence

Missing User Warnings

Rp1

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Session Persistence

Install Process

Missing User Warnings

Context-Inappropriate Capability

Natural-Language Policy Violations

Intent-Code Divergence

Context-Inappropriate Capability

Static analysis