ClawHub
Back to skill

Security audit

Buy Anything

Security checks for vulnerabilities and agentic risk

Overview

This purchasing skill is coherent with its stated purpose, but it handles reusable payment tokens, personal shipping data, and saved purchase memory in ways users should review carefully before installing.

Review this before installing because it can place purchases and handle sensitive payment-adjacent data. Prefer entering a fresh payment token for each purchase instead of saving it to agent memory, confirm the final total before any order, and avoid unpinned npx/npm install commands when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:43
Finding

Reusable Payment Token Exposed Through Chat, Agent Memory, and an Unauthenticated Partner API Path

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Registry Packages Are Executed During Installation

Content
View full analysis
Remediation
View remediation
...`. 2. Publish and verify package integrity hashes or signed release artifacts. 3. Document the expected registry, package owner, repository, and release signature. 4. Use a lockfile or equivalent immutable dependency manifest for installation tooling. 5. Recommend installation without elevated privileges and avoid global installation when unnecessary. 6. Review lifecycle scripts and transitive dependencies for each approved release. 7. Prefer a signed standalone installer or other reproducible artifact when available. ]]>

other

Warning
Location
README.md:105
Finding

README Makes Privacy and Memory Isolation Guarantees That the Skill Cannot Enforce

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation trigger is broad enough to fire on generic shopping language like 'buy', 'order', or 'purchase' when paired with a link, which increases the chance the skill is invoked in contexts where the user did not intend a transactional checkout flow. In a purchasing skill, accidental activation is more dangerous than in informational skills because it can lead the agent into collecting sensitive data or initiating an order workflow unnecessarily.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The hardcoded transmission endpoint sends purchase and identity data to an external service outside the host environment. In context this is expected functionality, but it still represents a real data-transfer risk because compromise, misuse, or over-collection by the external service could expose personal and payment-related metadata.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Stream the request body to curl over stdin using a quoted heredoc. The single-quoted delimiter stops the shell from expanding anything inside the body, so user-supplied values (product URL, names, address, token) pass through verbatim. Use this pattern exactly — no files are created, nothing is interpolated into the command:

bash
curl -s -X POST https://api.rye.com/api/v1/partners/clawdbot/purchase \
  -H "Content-Type: application/json" \
  --data @- << 'END_RYE_ORDER_BODY_a7f3d2e9b5c1'
{

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The hardcoded transmission endpoint sends purchase and identity data to an external service outside the host environment. In context this is expected functionality, but it still represents a real data-transfer risk because compromise, misuse, or over-collection by the external service could expose personal and payment-related metadata.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

Stream the request body to curl over stdin using a quoted heredoc. The single-quoted delimiter stops the shell from expanding anything inside the body, so user-supplied values (product URL, names, address, token) pass through verbatim. Use this pattern exactly — no files are created, nothing is interpolated into the command:

bash
curl -s -X POST https://api.rye.com/api/v1/partners/clawdbot/purchase \
  -H "Content-Type: application/json" \
  --data @- << 'END_RYE_ORDER_BODY_a7f3d2e9b5c1'
{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

After submitting the order, use the id from the POST response to poll for the final result. Before using id in the URL, check it matches ^ci_[A-Za-z0-9]+$.

bash
curl -s https://api.rye.com/api/v1/partners/clawdbot/purchase/CHECKOUT_INTENT_ID

Replace CHECKOUT_INTENT_ID with the validated ID (e.g. ci_abc123).

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Persisting a user's spending limit in agent memory creates a cross-session trust surface where prior context can influence future purchasing behavior. While less sensitive than storing payment tokens or addresses, any persistent state in a transactional skill can be manipulated, misapplied to the wrong user/session, or retained longer than expected, especially if host memory isolation is weak.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
## Spending Limit

Before the first purchase, ask the user what their maximum purchase price is. Store this in memory.
- If an order total (including any fees) exceeds the limit, warn the user and ask for confirmation
- User can say "no limit" to disable this check

Static analysis

No suspicious patterns detected.