ecommerce-carbon-analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:13 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent ecommerce carbon-cost calculator with disclosed local MCP tools and LLM provider use, though its dependencies should be pinned before use in sensitive environments.

Use the offline check when you only need to verify the calculation. If you run the LLM client, do it in a virtual environment, expose only the API key for the provider you choose, and pin or lock the dependencies first for production or sensitive use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: ecommerce-carbon-analyzer/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Allow Unreviewed Future Releases

Content

View full analysis

Vulnerability Details

File Location: ecommerce-carbon-analyzer/requirements.txt, lines 1–5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

text

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

The installation command appears in SKILL.md, line 69:

bash

pip install -r requirements.txt

Technical Analysis

All third-party packages are specified using lower-bound-only version constraints. Consequently, installation may retrieve any newer release accepted by the resolver, including releases that were never reviewed with this Skill. No lockfile, upper bounds, or package hashes constrain the resolved artifacts.

This is a supply-chain hardening weakness rather than evidence that the named packages are currently malicious. Exploitation requires a permitted package release or its distribution channel to become compromised, or a future package version to introduce unsafe behavior. Installed packages execute with the Python process's privileges and can run during installation or import.

Attack Path

1. A user follows the documented installation procedure.
2. pip resolves the newest package versions satisfying the lower-bound constraints.
3. A compromised or unexpectedly unsafe future release is selected because no exact version or hash restricts it.
4. Package-controlled code executes during installation, import, or runtime.
5. That code inherits the user's process privileges and may access environment variables, including configured LLM API keys, as well as files accessible to the user.

This path is conditional on compromise or unsafe modification of an allowed dependency release; the audit found no evidence that the currently named upstream packages are malicious.

Impact Assessment

A compromised dependency could execute code with the privileges of the user running the installation or application. Potential scope includes:

• Reading ...[truncated 487 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound-only constraints with exact, reviewed versions:

text

mcp==<reviewed-version>
fastmcp==<reviewed-version>
openai==<reviewed-version>
anthropic==<reviewed-version>
python-dotenv==<reviewed-version>

2. Generate and commit a reproducible lockfile appropriate for the project tooling.
3. Require hashes for all resolved distributions, for example with pip install --require-hashes -r requirements.lock.
4. Prefer an explicitly configured trusted package index and prevent unintended fallback to untrusted indexes.
5. Review transitive dependencies, not only the five direct dependencies.
6. Use automated dependency and vulnerability scanning, but update locked versions only through a reviewed process.
7. Install and run the Skill in an isolated virtual environment or container with minimal filesystem and environment access.
8. Expose only the API key needed for the selected provider rather than placing all provider credentials in the same runtime environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ecommerce-carbon-analyzer/llm_client.py (reported line 183)May include surrounding context.

python

def make_provider(name, model):
    api_key = os.getenv(f"{name.upper()}_API_KEY")
    if not api_key:
        raise SystemExit(f"缺少 {name.upper()}_API_KEY，请在 .env 或环境变量中配置")
    if name in ("openai", "deepseek"):
        return OpenAIProvider(model, api_key, base_url=BASE_URLS[name])
    return AnthropicProvider(model, api_key)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes capabilities involving environment access and MCP-backed code paths, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host agent may grant broader access than intended, increasing the risk of unintended tool invocation, data exposure, or privilege creep when the skill is executed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is written as an instruction to use the skill when the user asks in Chinese contexts and the skill content consistently directs responses in Chinese, but it does not offer any language or locale choice. This can violate a language/locale policy when a skill implicitly constrains output language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and all user-facing guidance are written only in Chinese, and the system prompt also instructs the model in Chinese. This creates a locale/language constraint without any visible opt-in or alternative language path, which matches the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language system prompt is entirely in Chinese and defines the assistant's behavior in that language, with no indication that the user may choose another language. This is a language-policy issue because the skill constrains interaction locale implicitly rather than by explicit user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file’s natural-language instructions and descriptions are entirely in Chinese, including the module docstring describing the server behavior. Under the policy, forcing a specific language without offering a user choice or documenting a justified region-specific constraint is a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module docstring and subsequent printed messages are written entirely in Chinese, which imposes a specific language on users of the skill. The file does not provide any opt-in, fallback, or explanation that the skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with only a lower bound, so builds may resolve to different versions over time, including versions with known security defects or breaking changes. In a security-sensitive MCP-based skill, this weakens supply-chain integrity and makes it impossible to verify whether deployed environments are using a safe release.

Content

Scanner excerpt · ecommerce-carbon-analyzer/requirements.txt (reported line 1)May include surrounding context.

text

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin mcp, and the package family has multiple known advisories, including issues affecting validation, DNS rebinding protections, and task access controls. Because the actual installed version is unknowable from this file, the deployment may pull an affected release, which is more concerning here because the skill explicitly depends on MCP tooling for external data access.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using fastmcp>=2.0.0 allows any newer release to be installed, which can silently introduce vulnerable or incompatible code. Because this skill appears to rely on MCP tooling and server/client interactions, uncontrolled upgrades increase supply-chain and runtime risk.

Content

Scanner excerpt · ecommerce-carbon-analyzer/requirements.txt (reported line 2)May include surrounding context.

text

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

Unverifiable Dependency: fastmcp has 14 known advisory(ies) (CVE-2025-69196 (FastMCP OAuth Proxy token reuse across MCP servers); GHSA-c2jp-c369-7pvx (FastMCP Auth Integration Allows for Confused Deputy Account Takeover); CVE-2025-64340 (FastMCP has a Command Injection vulnerability - Gemini CLI) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

fastmcp has known advisories, including high-risk categories like token reuse, confused deputy issues, and command injection, but the unpinned requirement prevents verification that a safe version is installed. Given this skill's MCP-centric purpose, any weakness in FastMCP could directly affect tool invocation, authentication boundaries, or command execution paths.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

openai>=1.0.0 is not reproducible and permits unreviewed future releases to enter the environment. While not inherently exploitable on its own, this practice increases the chance of introducing vulnerable or behavior-changing SDK versions into production.

Content

Scanner excerpt · ecommerce-carbon-analyzer/requirements.txt (reported line 3)May include surrounding context.

text

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The Anthropic SDK is unpinned, so future installs may resolve to versions with known vulnerabilities or unsafe defaults. This is especially relevant for an LLM-integrated skill that may process secrets, external tool responses, and user-controlled inputs.

Content

Scanner excerpt · ecommerce-carbon-analyzer/requirements.txt (reported line 4)May include surrounding context.

text

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The Anthropic SDK has reported advisories, and because the requirement is unpinned there is no assurance the deployed version is outside affected ranges. The risk is somewhat contextual, but for an LLM-enabled assistant that may handle filesystem or tool-mediated data, unverifiable SDK versions create avoidable uncertainty and attack surface.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

python-dotenv>=1.0.0 allows uncontrolled upgrades of a package that directly affects environment-variable and file handling. If a vulnerable release is installed, this can expose configuration secrets or unsafe file operations depending on how the package is used elsewhere in the skill.

Content

Scanner excerpt · ecommerce-carbon-analyzer/requirements.txt (reported line 5)May include surrounding context.

text

fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

python-dotenv has known advisories related to filesystem behavior, and without version pinning the environment may install an affected release. If the application uses dotenv write/update features, a vulnerable version could enable unsafe file overwrite scenarios or mishandling of sensitive configuration files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.