icosmos shopify

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:36 AM UTC
• Version: 0.0.1

Overview

This Shopify skill is coherent in purpose, but it asks users to give account credentials to an unaudited local tool and cache privileged store tokens with unclear safeguards.

Review before installing. Use only if you trust the publisher and can verify the icosmos-shopify executable separately. Prefer short-lived or scoped credentials, avoid persistent system-wide password environment variables, confirm where tokens are cached and how to delete or rotate them, and require explicit confirmation before any blog publishing or sensitive store diagnostics.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:13

Finding

Unauditable External Executable Handles Account Credentials and Privileged Shopify Tokens

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–14 and 55–64
Vulnerability Type: Sensitive credential exposure and insecure local token storage
Risk Level: Medium

Relevant Code Snippets:

text

- **触发后执行顺序**：
  1. `setup once`：用 `ICOSMOS_USER_EMAIL` / `ICOSMOS_USER_PASSWORD` 同步店铺与 token 到本地缓存

text

## 依赖与配置

- Setup Onece：

  - `ICOSMOS_USER_EMAIL`
  - `ICOSMOS_USER_PASSWORD`

  两个字段需要保存到系统环境变量

  所需命令行工具为当前目录下的[icosmos-shopify](icosmos-shopify)

Technical Analysis

The skill directs users to place an account email and password in environment variables and invoke an icosmos-shopify executable that retrieves Shopify domains and privileged tokens from Supabase. It then stores those tokens in an unspecified local cache.

Environment variables may be inherited by child processes or exposed through process diagnostics, crash reports, debug output, or other software running under the same account. The document does not define the cache location, access permissions, encryption, retention period, deletion procedure, or token scope.

The referenced icosmos-shopify executable is absent from the audited project, which contains only SKILL.md. Consequently, the audit cannot verify the executable's provenance, network destinations, credential handling, cache protections, or implementation of the claimed token redaction and write-confirmation safeguards. The documented masking of tokens in logs does not protect credentials held in the process environment or tokens stored in the local cache.

Attack Path

1. A user loads the skill and places ICOSMOS_USER_EMAIL and ICOSMOS_USER_PASSWORD in system environment variables as instructed.
2. The user invokes icosmos-shopify setup once.
3. The external executable receives the account credentials, authenticates to the associated service, and retrieves Shopify store tokens.
4. The executable writes the retrieved tokens to an u ...[truncated 1240 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced executable and its source code in the auditable package, or identify a pinned and cryptographically verifiable official distribution.
2. Replace reusable password-based environment authentication with short-lived credentials, an OAuth authorization flow, or another revocable token mechanism.
3. Avoid system-wide or persistent environment variables for passwords. If environment-based transfer is unavoidable, scope variables to a single process and remove them immediately after use.
4. Store Shopify tokens in an operating-system credential manager or dedicated secret-management service rather than an unspecified plaintext cache.
5. If a local cache is required, encrypt it, restrict permissions to the owning user, prevent symbolic-link attacks, use atomic file creation, and document its exact location.
6. Define token retention, expiration, rotation, revocation, and secure-deletion procedures.
7. Request the minimum Shopify API scopes required for each operation and separate read-only credentials from credentials capable of publishing content.
8. Document and restrict all network endpoints contacted during setup, and validate their TLS certificates.
9. Ensure secrets are excluded from logs, command output, exception traces, telemetry, and crash reports. Automated tests should verify these protections.
10. Independently verify that blog publication cannot occur without explicit confirmation and that checkout diagnostics remain read-only.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

## 常见问题与排障

- **401/403**：Admin token scopes 不足或 token 过期；确认 Shopify Custom App 的 Admin API access token 与权限。
- **429 Too Many Requests**：已做退避重试；如果频繁触发，降低并发/减少拉取字段/缩小时间范围。
- **Storefront 430 Security Rejection**：请求可能被判定为异常；需要检查请求来源、token 是否正确，必要时增加更真实的请求头策略（后续增强）。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file consistently presents operational instructions, triggers, and safety guidance only in Chinese. This effectively imposes a language requirement without user opt-in or a documented business/regional justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger section uses broad operational keywords such as store audit, checkout testing, conversion decline, and blog publishing without documenting exclusion constraints, approval checks, or stronger disambiguation. In an agent environment, this can cause unintended activation on loosely related prompts and may lead to unnecessary access to shop data or accidental progression toward the skill’s write-capable path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.