Etsy Pod Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.0

Overview

The skill matches its Etsy automation purpose, but it gives agents broad live-store, public-posting, scheduled automation, and listing-retirement authority without clear approval gates.

Install only if you are comfortable giving an agent access to Etsy, Printify, scraping providers, and social-media posting tools. Use least-privilege tokens, require dry-run previews and explicit approval before publishing, posting, changing prices, or retiring listings, and avoid unattended cron automation until those safeguards are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/workflows.md:4

Finding

Unpinned Third-Party Etsy Scraper Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/workflows.md, line 4
Vulnerability Type: Unpinned and unverified third-party scraper dependency
Risk Level: Medium

Complete Code Snippet:

markdown

2. **Etsy Trending Searches** – Pull top 20 search terms via `sovereigntaylor/etsy-scraper`.

Technical Analysis

The trend-research workflow instructs the agent to use the third-party Apify actor sovereigntaylor/etsy-scraper. The instruction does not pin a reviewed actor build or version, verify artifact integrity, require source review, or define a trust policy for the returned data.

Because the named actor is externally maintained and mutable, its behavior can change after this Skill has been audited. Although the reviewed Skill does not explicitly transmit .env credentials to this actor, invoking an external scraper necessarily exposes the supplied scraper inputs and associated request metadata to that service. Its output is then treated as trusted input for trend scoring and subsequent AI-driven product creation.

This exceeds the minimum safe privilege model because the declared functionality only requires Etsy trend data; it does not inherently require trusting an unpinned community-maintained component. An official Etsy data source or a pinned and reviewed scraper implementation would provide the necessary functionality with less supply-chain exposure.

Attack Path

1. An attacker compromises the maintainer account, actor source, build process, or runtime associated with sovereigntaylor/etsy-scraper, or the actor is otherwise updated with unsafe behavior.
2. The automated trend workflow invokes the actor by its mutable name without pinning or integrity verification.
3. The modified actor receives the workflow inputs and returns attacker-controlled search terms or other crafted content.
4. The workflow stores or processes that output as trend data and feeds it into scoring and AI design-g ...[truncated 1143 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an official Etsy API or another first-party, documented source for trend data.
2. If the third-party Apify actor must be retained, pin an explicitly reviewed immutable build or version rather than invoking only its mutable actor name.
3. Review the actor's source code, ownership, requested permissions, network destinations, and data-retention policy before use.
4. Verify artifact integrity where supported and periodically re-audit the exact pinned release.
5. Supply only public search keywords. Never provide Etsy, Printify, social-media, or unrelated environment credentials to the scraper.
6. Use a dedicated least-privilege Apify credential with strict spending, runtime, concurrency, and network limits.
7. Treat all returned fields as untrusted data. Enforce schemas, field-length limits, character restrictions, and expected record counts before storing or processing results.
8. Prevent scraper output from being interpreted as agent instructions. Delimit external content clearly and use it only as data in downstream prompts.
9. Require human approval before trend results can trigger product creation, Etsy publication, listing retirement, or social-media posting.
10. Log the actor version, invocation time, sanitized inputs, output validation results, and downstream actions to support incident investigation and rollback.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises very broad trigger phrases such as 'run Etsy POD store' and 'automate Etsy listings,' which could cause it to activate for loosely related e-commerce requests without clear user intent. In a skill that can publish listings and post to social media, overbroad activation increases the chance of unintended high-impact actions on external accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow explicitly includes Etsy listing publication and social media posting, but the skill text does not warn that these actions affect live storefronts, public content, and connected third-party accounts. Without explicit confirmation and safety gates, an agent could create or publish unintended listings, expose product data publicly, or post unwanted promotional content under the user's brand.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/workflows.md (reported line 21)May include surrounding context.

md

5. Choose top‑ranked design (based on aesthetic score or user feedback).

## 3. Printify Product Creation Workflow
1. **Discover Shop ID** – `GET https://api.printify.com/v1/shops.json` → store `shop_id`.
2. **Select Blueprint** – `GET /v1/catalog/blueprints.json` → find matching product type (e.g., mug).
3. **Find Provider & Variant** – `GET /v1/catalog/blueprints/{id}/print_providers.json` then `/variants.json`.
4. **Calculate Pricing** – Use pricing formula from SKILL.md.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow explicitly states that bottom-performing Etsy listings should be retired automatically after 14 days, with no requirement for user review, warning, or confirmation. In an automation skill that can directly modify a live storefront, this creates a real risk of unintended business-impacting actions such as deleting or deactivating listings that the user may want to keep for seasonal, strategic, or delayed-traffic reasons.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file states that API authentication tokens are stored in .env, which indicates the skill uses sensitive credentials. Although it notes that token files should be secured, it does not clearly warn users about the privacy and security implications of granting the automation access to marketplace and social-media accounts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.