ecommerce-carbon-analyzer

• Outcome: Pass
• Latest audit: Aug 27, 2026 · 10:43 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate ecommerce carbon calculator with an optional LLM/MCP demo, but users should understand the external LLM and dependency risks before use.

Install only in an environment where you are comfortable using external LLM APIs for the provided questions and tool outputs. Prefer running offline_check.py for local validation, avoid --verbose with sensitive data, and pin or update the requirements before production use.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and documents executable components that use MCP and environment-backed configuration, but the manifest does not declare corresponding permissions. This creates a transparency and policy gap: a host or reviewer may underestimate the skill’s ability to access secrets or invoke external toolchains, increasing the chance of unintended data exposure or unauthorized execution paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is described as a bounded ecommerce carbon calculator, but the bundled workflow also supports sending user prompts to third-party LLM providers using API keys from the environment. That mismatch is dangerous because users and integrators may provide commercial or logistics data expecting local calculation, while the skill can route it to external services and perform broader conversational orchestration than declared.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: In verbose mode, the client logs full tool arguments and raw tool outputs to stdout. If user questions, product metadata, shipping destinations, or future tool responses contain sensitive business or personal data, those details may be exposed in terminal history, CI logs, or shared observability systems without any redaction or warning.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only, allowing future installs to resolve to any newer version, including breaking or compromised releases. In a security-sensitive skill that relies on MCP infrastructure, unpinned dependencies reduce build reproducibility and increase supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 97% confidence
• Finding: Using fastmcp with only a minimum version means deployments may silently install different versions over time, including versions with severe security regressions. Because FastMCP sits close to tool execution and protocol handling, supply-chain instability here is more dangerous than for a purely local utility library.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 93% confidence
• Finding: An unpinned openai client version makes builds non-reproducible and can introduce unexpected behavior or newly introduced vulnerabilities at install time. While this is a common packaging issue, it still expands supply-chain exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

mcp>=1.0.0
fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: The anthropic dependency is not fixed to a vetted version, so future installs may pull different code than what was originally tested. This weakens reproducibility and may import vulnerable or incompatible releases unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastmcp>=2.0.0
openai>=1.0.0
anthropic>=0.30.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: python-dotenv is unpinned, which permits unreviewed versions to be installed and can expose the project to supply-chain issues or known flaws in certain releases. Since dotenv libraries often interact with local files and environment configuration, this can affect secrets handling and local file safety.

Known Vulnerable Dependency: mcp==1.0.0 — 10 advisory(ies): CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2025-53365 (MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to ) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirements allow mcp>=1.0.0, and the scanner indicates mcp 1.0.0 carries multiple known advisories including transport and DNS rebinding-related issues. If dependency resolution selects a vulnerable 1.x release, an attacker may exploit protocol-handling weaknesses in a skill that queries external MCP services, making the context more sensitive.

Known Vulnerable Dependency: fastmcp==2.0.0 — 10 advisory(ies): CVE-2025-69196 (FastMCP OAuth Proxy token reuse across MCP servers); GHSA-c2jp-c369-7pvx (FastMCP Auth Integration Allows for Confused Deputy Account Takeover); CVE-2025-64340 (FastMCP has a Command Injection vulnerability - Gemini CLI) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: The scanner flags fastmcp 2.0.0 with multiple severe advisories, including command injection and authentication issues. Because this skill's stated function depends on llm+mcp interactions and likely tool/server communication, a vulnerable FastMCP component materially increases the risk of remote code execution, confused-deputy abuse, or cross-server token misuse.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The scanner identifies python-dotenv 1.0.0 as affected by a symlink-following arbitrary file overwrite issue. If the skill or its deployment tooling writes .env data in a directory influenced by an attacker, this could overwrite unintended files or corrupt configuration, potentially affecting secrets or startup behavior.

Static analysis

No suspicious patterns detected.