ClawHub
Back to skill

Security audit

kroger

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent Kroger API helper, but confirmed unsafe local code execution paths and weak OAuth token handling make it a Review item.

Review before installing or using. Use only in an environment you trust, avoid passing untrusted product search text, store the token file somewhere private with restrictive permissions, and require explicit confirmation before authentication or any add-to-cart action. The artifact does not show hidden exfiltration or destructive behavior, but the confirmed coding flaws are serious enough to warrant Review rather than normal installation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/kroger.sh:106
Finding

Arbitrary Python Code Execution Through Unsafe String Interpolation

Content
View full analysis
"`. 3. `cmd_search` inserts the term into the source string passed to `python3 -c`. 4. The crafted value terminates the expected Python string and adds attacker-selected Python code. 5. Python executes the injected code locally before or while URL encoding is attempted. 6. The injected code operates with the same filesystem, environment, network, and process privileges as the Skill. The same underlying path is possible through a malicious `KROGER_REDIRECT_URI` when `scripts/kroger.sh auth` is run. ### Impact Assessment Successful exploitation permits arbitrary local code execution under the account running the Skill. Depending on that account's permissions, an attac ...[truncated 494 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kroger.sh:74
Finding

OAuth Tokens Stored Without Explicitly Restrictive File Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/kroger.sh:104
Finding

OAuth Authorization Flow Does Not Validate a State Parameter

Content
View full analysis
Success! Close this tab.') print(f'CODE:{code}') else: self.send_response(400) self.end_headers() print('ERROR:no_code') sys.stdout.flush() threading.Thread(target=self.server.shutdown).start() def log_message(self, *a): pass s = http.server.HTTPServer(('localhost', $port), H) print(f'Listening on port $port...') sys.stdout.flush() s.handle_request() " 2>&1 | while IFS= read -r line; do if [[ "$line" == CODE:* ]]; then code="${line#CODE:}" response=$(curl -sf -X POST "$API/connect/oauth2/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -u ...[truncated 2293 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description overstates capabilities by claiming shopping list management and broader cart management that are not implemented in the documented actions. This mismatch can mislead an orchestrating agent or user into trusting the skill for operations it cannot safely perform, which may cause incorrect automation decisions or unsafe fallbacks when handling shopping or account actions.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/kroger.sh (reported line 33)May include surrounding context.

sh
get_client_token() {
  local resp
  resp=$(curl -sf -X POST "$API/connect/oauth2/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -u "$KROGER_CLIENT_ID:$KROGER_CLIENT_SECRET" \
    -d "grant_type=client_credentials&scope=product.compact")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/kroger.sh (reported line 140)May include surrounding context.

sh
" 2>&1 | while IFS= read -r line; do
      if [[ "$line" == CODE:* ]]; then
        code="${line#CODE:}"
        response=$(curl -sf -X POST "$API/connect/oauth2/token" \
          -H "Content-Type: application/x-www-form-urlencoded" \
          -u "$KROGER_CLIENT_ID:$KROGER_CLIENT_SECRET" \
          -d "grant_type=authorization_code&code=$code&redirect_uri=$REDIRECT_URI")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/kroger.sh (reported line 202)May include surrounding context.

sh
token=$(get_user_token) || return 1

  local status
  status=$(curl -s -o /dev/null -w "%{http_code}" -X PUT "$API/cart/add" \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    -d "{\"items\":[{\"upc\":\"$product_id\",\"quantity\":$qty}]}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs use of shell commands, environment variables, networked OAuth/API access, and token file storage, but it does not declare any explicit tool scope or permissions boundaries. That creates an overbroad execution surface where an agent may invoke sensitive capabilities implicitly, increasing the chance of unintended command execution, credential exposure, or unauthorized external requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation text is broad enough to match many ordinary grocery-related requests, while the skill has the ability to authenticate and perform state-changing actions like adding products to a Kroger cart. In context, this increases the risk of accidental or premature invocation for general food queries, potentially leading to unintended account-linked actions or unnecessary exposure of credentials/tokens.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kroger.sh (reported line 27)May include surrounding context.

sh
TOKEN_FILE="${KROGER_TOKEN_FILE:-$HOME/.kroger-tokens.json}"
REDIRECT_URI="${KROGER_REDIRECT_URI:-http://localhost:8888/callback}"
LOCATION_ID="${KROGER_LOCATION_ID:-}"
API="https://api.kroger.com/v1"

# --- Token helpers ---

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kroger.sh (reported line 33)May include surrounding context.

sh
get_client_token() {
  local resp
  resp=$(curl -sf -X POST "$API/connect/oauth2/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -u "$KROGER_CLIENT_ID:$KROGER_CLIENT_SECRET" \
    -d "grant_type=client_credentials&scope=product.compact")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

OAuth access and refresh tokens are persisted to disk in a predictable local file without any permission hardening or user-facing warning. On multi-user systems or misconfigured environments, another local process or user could read the file and reuse the tokens to act on the victim's Kroger account, including cart actions and token refresh.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kroger.sh (reported line 140)May include surrounding context.

sh
" 2>&1 | while IFS= read -r line; do
      if [[ "$line" == CODE:* ]]; then
        code="${line#CODE:}"
        response=$(curl -sf -X POST "$API/connect/oauth2/token" \
          -H "Content-Type: application/x-www-form-urlencoded" \
          -u "$KROGER_CLIENT_ID:$KROGER_CLIENT_SECRET" \
          -d "grant_type=authorization_code&code=$code&redirect_uri=$REDIRECT_URI")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kroger.sh (reported line 202)May include surrounding context.

sh
token=$(get_user_token) || return 1

  local status
  status=$(curl -s -o /dev/null -w "%{http_code}" -X PUT "$API/cart/add" \
    -H "Authorization: Bearer $token" \
    -H "Content-Type: application/json" \
    -d "{\"items\":[{\"upc\":\"$product_id\",\"quantity\":$qty}]}")

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file header states 'kroger.sh cart - View cart (if supported)', suggesting users can invoke a cart-view operation. However, the main command dispatcher does not include a 'cart' branch and no cart-view function exists, so the documentation actively misstates available behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill supports managing a Kroger shopping list and viewing/managing a cart, but the implemented command set only exposes auth, token, search, add, locations, and manual code exchange. The header comment also mentions a 'cart' command, but no such command exists in the dispatcher, and there is no shopping-list functionality anywhere in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.