ClawHub
Back to skill

Security audit

TrueProfit - Shopify net profit tracking

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its TrueProfit analytics purpose, but it tells the agent to replace its installed skill file with unverified remote content, which needs user review before installation.

Install only if you are comfortable connecting an authenticated TrueProfit account and using it for merchant analytics. Do not follow the documented self-update step automatically; updates should be reviewed through a trusted package or marketplace flow, with a visible diff and provenance check before replacing any installed skill file.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:231
Finding

Unverified Remote Skill Update Can Poison Persistent Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 231–239
Vulnerability Type: Persistent instruction poisoning through an unverified remote update
Risk Level: Medium

Complete Code Snippet:

markdown
## Keeping the Skill Up to Date

TrueProfit MCP is actively developed — new tools and workflows are added regularly. To get the
latest version of this skill, call the `get_skill` tool from the TrueProfit MCP server:

get_skill → copy the returned SKILL.md content → overwrite ~/.claude/skills/trueprofit/SKILL.md

text

Do this periodically (e.g., once a month) or whenever you notice a tool behaving differently
than documented here.

Technical Analysis

The skill directs the agent to retrieve mutable instruction content from a remote MCP server and overwrite the persistent local skill file at ~/.claude/skills/trueprofit/SKILL.md. The procedure does not require a cryptographic signature, pinned version, expected checksum, content review, diff inspection, or explicit approval immediately before installation.

Because SKILL.md controls future agent behavior, replacing it with remotely supplied content creates a persistent instruction-poisoning channel. The effective behavior of the installed skill can change after the reviewed package has been approved. A compromised MCP server, compromised publishing account, malicious upstream release, or intercepted update mechanism could supply instructions that redirect tool calls, weaken confirmation requirements, expose merchant data, or introduce additional unsafe behavior.

This is classified as T02: Agent Memory Poisoning rather than remote code execution because the demonstrated behavior overwrites persistent agent instructions, not executable source code. The reviewed content does not prove that the current TrueProfit server is malicious.

Attack Path

  1. An attacker compromises the TrueProfit MCP service, its skill publishing account, or ...[truncated 1407 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to overwrite the installed skill directly from a mutable get_skill response.
  2. Publish versioned skill releases and pin installations to an explicitly selected version.
  3. Cryptographically sign releases and verify the signature against a trusted, locally configured public key before installation.
  4. Publish an expected SHA-256 or stronger digest through an independently authenticated channel and verify it before use.
  5. Download updates to a temporary staging file rather than writing directly to the active skill path.
  6. Display a complete diff and require explicit user approval for every update, particularly for changes involving tool use, authentication, data transmission, persistent storage, or state-changing operations.
  7. Validate the updated document against an allowlist of expected metadata and reject unexpected executable instructions, external endpoints, or expanded tool permissions.
  8. Retain the previous reviewed version and provide an atomic rollback procedure.
  9. Record the installed version, digest, source, verification result, and approval event in an audit log.
  10. Subject each new version to the same security review as the original skill before activating it.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough to auto-activate on many generic e-commerce analytics queries, not just cases that clearly require this MCP. Over-broad activation increases the chance the agent will invoke this skill and its associated tools in situations the user did not intend, creating unnecessary data exposure and expanding the trusted execution surface.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
95% confidence
Finding

The skill instructs the agent to fetch remote content via get_skill and overwrite the local skill file, which effectively allows externally supplied instructions to replace trusted local behavior. This creates a supply-chain style risk: if the server, transport, or returned content is compromised, persistent malicious instructions could be installed and used in future sessions.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

latest version of this skill, call the get_skill tool from the TrueProfit MCP server:

text
get_skill → copy the returned SKILL.md content → overwrite ~/.claude/skills/trueprofit/SKILL.md

Do this periodically (e.g., once a month) or whenever you notice a tool behaving differently

Session Persistence

Medium
Category
Rogue Agent
Confidence
97% confidence
Finding

The instruction to overwrite ~/.claude/skills/trueprofit/SKILL.md directs the agent toward modifying persistent local state. Persistent writes are dangerous because they survive the current session and can be abused to implant altered instructions, change future agent behavior, or maintain unauthorized persistence even after the original interaction ends.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

latest version of this skill, call the get_skill tool from the TrueProfit MCP server:

text
get_skill → copy the returned SKILL.md content → overwrite ~/.claude/skills/trueprofit/SKILL.md

Do this periodically (e.g., once a month) or whenever you notice a tool behaving differently

Static analysis

No suspicious patterns detected.