icosmos

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:36 AM UTC
• Version: 0.0.1

Overview

This Shopify diagnostic skill is mostly purpose-aligned, but it asks agents to use sensitive store credentials and a missing local command-line tool whose behavior cannot be verified.

Review before installing. Only use this in an environment where the intended icosmos-shopify executable is installed from a trusted source and invoked explicitly. Provide least-privilege Shopify/Supabase credentials, confirm the store before running setup or diagnostics, and verify how the local token cache is protected and removed. Treat blog publishing as a real write action even though the skill documents a --confirm requirement.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:24

Finding

Unresolved CLI Executable Allows Tool Hijacking Through PATH Spoofing

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-34,55
Vulnerability Type: Untrusted executable resolution and missing referenced implementation
Risk Level: Medium

Vulnerable Code Snippet

text

`icosmos-shopify setup once`
`icosmos-shopify stores list`
`icosmos-shopify content shop --store xxx.myshopify.com`
`icosmos-shopify content products list --store xxx.myshopify.com --first 20 --after <cursor>`
`icosmos-shopify content orders list --store xxx.myshopify.com --start <RFC3339> --end <RFC3339>`
`icosmos-shopify content blogs list --store xxx.myshopify.com`
`icosmos-shopify content blogs articles list --store xxx.myshopify.com --blog-id 123`
`icosmos-shopify audit theme --store xxx.myshopify.com`
`icosmos-shopify audit products --store xxx.myshopify.com --limit 50`
`icosmos-shopify test checkout --store xxx.myshopify.com`
`icosmos-shopify audit metrics --store xxx.myshopify.com --days 7`
`icosmos-shopify blog publish --store xxx.myshopify.com --blog-id 123 --title ... --body-file article.html --confirm`

[icosmos-shopify](icosmos-shopify)

Technical Analysis

The skill directs the agent to invoke icosmos-shopify by its bare executable name. It also states that the tool is available in the current directory through a relative link, but the audited project contains only SKILL.md; the referenced executable is absent.

When a bare command is passed to a shell or process launcher, executable resolution generally depends on the active PATH. Because the expected executable is not included in the package and no absolute or verified relative path is enforced, another executable named icosmos-shopify can be selected. This creates a tool-spoofing opportunity in environments where an attacker can influence PATH or write to an earlier searched directory.

The setup operation is especially sensitive because the skill specifies that ICOSMOS_USER_EMAIL and `ICOSMOS_US ...[truncated 2515 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced icosmos-shopify implementation in the package so its behavior can be audited.
2. Invoke the tool through a canonical, explicit path resolved relative to the trusted skill directory rather than relying on a bare command name or the caller's current working directory.
3. Verify the executable before launch using a pinned cryptographic hash, authenticated package signature, or equivalent integrity control.
4. Reject execution if the expected executable is absent, is a symbolic link to an untrusted location, has unexpected ownership or permissions, or fails integrity verification.
5. Launch the tool with a minimal, controlled PATH and a sanitized environment. Pass credentials only to the specific trusted process that requires them.
6. Store cached Shopify tokens in an operating-system credential store or an encrypted file with restrictive permissions instead of an unspecified local cache.
7. Document and restrict the network endpoints contacted during setup, including the expected Supabase and Shopify hosts.
8. Add automated tests confirming token redaction, sensitive-order-field suppression, read-only operation of audit commands, and mandatory --confirm enforcement for publication.
9. Pin the tool version and record its provenance so deployments cannot silently substitute another implementation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

## 常见问题与排障

- **401/403**：Admin token scopes 不足或 token 过期；确认 Shopify Custom App 的 Admin API access token 与权限。
- **429 Too Many Requests**：已做退避重试；如果频繁触发，降低并发/减少拉取字段/缩小时间范围。
- **Storefront 430 Security Rejection**：请求可能被判定为异常；需要检查请求来源、token 是否正确，必要时增加更真实的请求头策略（后续增强）。

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger section uses broad business keywords and an automatic execution sequence without explicit exclusion conditions or a required confirmation gate for diagnostic actions. In an agent environment, this can cause unintended activation against real Shopify stores, leading to unauthorized data access, token synchronization, and potentially sensitive operational analysis being performed when the user intent was ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.