Back to skill

Security audit

walmart-research

Security checks across malware telemetry and agentic risk

Overview

The skill is framed as Walmart-only research, but its bundled helper can make broader Crawlora API requests beyond Walmart, so it needs review before installation.

Review this skill before installing. It is probably intended as a Walmart research helper, but the bundled script is a generic Crawlora client, so only use it if you are comfortable with agents having broader Crawlora API access or after constraining the script to the Walmart endpoints you expect.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs the agent to invoke shell commands (`scripts/crawlora.sh`, `curl`, and `jq`) but does not declare corresponding permissions. Undeclared execution capability weakens reviewability and policy enforcement, because an operator may approve a seemingly low-privilege skill that can still trigger command execution and network access.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
A skill presented as Walmart-only is flagged as capable of reaching arbitrary Crawlora endpoints, including unrelated services and custom POST payloads. That mismatch is dangerous because it can mislead users and reviewers into authorizing a narrowly scoped shopping skill that actually functions as a general outbound data exfiltration or web-query proxy.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The helper is advertised for Walmart research, but the usage examples and interface expose a generic Crawlora client that can call arbitrary endpoints such as Amazon, YouTube, Google, and trends APIs. In an agent-skill context, this broadens the tool's effective capability beyond its declared scope, increasing the risk of unintended data access, policy bypass, or misuse through prompt-driven invocation of unrelated third-party research functions.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code accepts any caller-supplied path and method and forwards them directly to the Crawlora API, so the skill can be repurposed for unrelated third-party endpoints despite being presented as Walmart-focused. In a delegated agent environment, this mismatch is dangerous because it expands the attack surface and allows external requests outside the user's expected trust boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
  [ -n "$body" ] || body="${rest[0]:-{}}"
  curl -fsS -X "$method" "${auth[@]}" \
    -H "Content-Type: application/json" -d "$body" "${base}${path}"
fi
Confidence
88% confidence
Finding
curl -fsS -X "$method" "${auth[@]}" \ -H "Content-Type: application/json" -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:22