ClawHub
Back to skill

Security audit

Lobstersearch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real commerce connector, but its public unauthenticated order and refund-capable tools need careful review before use.

Install only if you are comfortable connecting your agent to a public hosted commerce endpoint. Treat order creation, confirmation, status lookup, and cancellation as sensitive actions: require explicit user approval, verify merchant, items, quantity, price, customer details, and refund consequences, and avoid letting an agent follow next_actions into a purchase flow automatically.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
mcp.json:7
Finding

Unauthenticated State-Changing Commerce Operations

Content
View full analysis

Vulnerability Details

File Location: mcp.json:7-9, mcp.json:131-193, and mcp.json:195-225
Vulnerability Type: Missing authentication and object-level authorization for sensitive commerce operations
Risk Level: High

Vulnerable Code

The MCP configuration explicitly declares that the hosted endpoint requires no authentication:

json
"endpoint": "https://mcp.lobstersearch.ai/mcp",
"transport": "streamable-http",
"authentication": "none",

The same public interface exposes order creation:

json
{
  "name": "create_order",
  "description": "Create a new draft order for a business. The order starts in 'draft' status with stock reserved. Items are specified by offering IDs (and optional variant IDs) and quantities. The order must be confirmed separately before payment.",
  "inputSchema": {
    "type": "object",
    "properties": {
      "business_id": {
        "type": "string",
        "description": "Business UUID"
      },
      "items": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "offering_id": {
              "type": "string",
              "description": "Offering UUID"
            },
            "variant_id": {
              "type": "string",
              "description": "Variant UUID (required for products with variants)"
            },
            "quantity": {
              "type": "number",
              "description": "Quantity",
              "minimum": 1,
              "maximum": 99
            }
          },
          "required": ["offering_id", "quantity"]
        },
        "minItems": 1,
        "maxItems": 20,
        "description": "Array of order items"
      },
      "customer_email": {
        "type": "string",
        "description": "Customer email for order notifications"
      },
      "customer_name": {
        "type": "string",
  
...[truncated 4384 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require authenticated user or service identities for every state-changing operation, including order creation, confirmation, and cancellation.
  2. Bind each order to its authenticated creator and enforce object-level authorization on confirm_order, get_order_status, and cancel_order.
  3. Do not use UUID secrecy as an authorization mechanism. Use server-validated sessions or narrowly scoped, signed, expiring capability tokens.
  4. Require explicit user approval immediately before operations that reserve stock, create payment sessions, cancel orders, or initiate refunds.
  5. Apply strict per-user, per-business, per-product, per-device, and per-network quotas to draft-order creation.
  6. Expire unpaid reservations quickly and restore inventory automatically. Consider requiring verified contact information or payment intent before reserving scarce stock.
  7. Add idempotency keys to write operations to prevent accidental or malicious duplicate submissions.
  8. Return only the minimum order information authorized for the requesting identity, and prevent personal or payment-related data from appearing in broadly accessible status responses.
  9. Record security audit events for order creation, confirmation, status access, cancellation, and refund initiation. Alert on abnormal reservation and cancellation patterns.
  10. Document the authentication and authorization model in mcp.json, README.md, and SKILL.md, including ownership requirements and approval boundaries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

Gemini CLI

Add to your ~/.gemini/settings.json:

json
{

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about an AI-native commerce agent with tools for business discovery, product catalog browsing, variants, and Stripe payments. The supplied code chunk only adds an MCP server configuration to Claude Code by pointing it at a remote endpoint. While this could be a setup step for such a service, the chunk itself does not implement or demonstrate the described commerce capabilities. Its primary purpose is installation/configuration, which is materially different from the declared end-user functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill exposes create_order, confirm_order, and cancel_order capabilities that can trigger real-world commerce effects, including payment initiation and refunds, yet the manifest provides no explicit warning that these are financially sensitive actions. In an agent ecosystem, this omission is dangerous because a model or orchestrator may treat these tools like ordinary data retrieval operations and invoke them without sufficiently strong user confirmation, causing unauthorized purchases, cancellations, or refund activity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README documents tools that can create orders, generate Stripe payment links, and cancel/refund orders, but it provides no explicit requirement for user confirmation or warning before an agent performs these actions. In an agentic commerce context, this increases the risk of unauthorized purchases, accidental payments, or unintended refunds if an LLM follows the documented flow autonomously.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This skill enables order creation, confirmation, and payment-link generation, but the usage guidance does not warn that these actions can trigger real-world purchases or financial commitments. In an agentic commerce context, missing warnings increase the risk of unintended transactions, especially if an autonomous agent follows the documented next steps without explicit user confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples show create_order and confirm_order as ordinary tool calls without any explicit warning that they can reserve inventory, process customer PII, and advance a real purchase flow. In an agentic commerce skill, this omission increases the risk that downstream agent developers treat these as low-risk read operations and invoke them without clear user confirmation, leading to unintended purchases or exposure of user/order data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest explicitly targets AI agents for commerce and shopping, but it does so in broad language without narrowing when autonomous shopping actions are appropriate. In practice, this increases the chance an agent will invoke discovery and transaction flows in contexts where the user did not intend real-world purchasing activity, creating elevated risk of unintended orders or downstream financial actions.

Content

No source excerpt is available for this finding.