clawauto-shop

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:33 PM UTC
• Version: 2.0.2

Overview

This skill is a disclosed food-ordering automation that can place paid/account-linked KFC and McDonald's orders, so it is not risk-free but its sensitive behavior matches its stated purpose.

Install only if you trust the clawauto-shop backend you configure and understand that purchase commands can create real orders or spend account balance. Use openclaw_skill.py rather than running helper scripts directly, keep the default no-final-submit behavior unless you intentionally want live submission, protect the .env/API key, and delete local outputs/order-state files when they are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The script is presented as a 'flow tester', but its default behavior can proceed through the final confirmation flow and submit a real KFC order unless the user explicitly passes --no-submit. In an automation/agent context, misleading framing materially increases the risk of unintended real-world transactions because operators may run it expecting a dry-run test.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script pre-grants geolocation permission via the browser context without any visible user disclosure or runtime consent flow. Even if location is operationally useful for store selection, silently enabling a sensitive permission exposes unnecessary privacy risk and normalizes hidden access to location-capable features.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The docstring frames the flow as retrieving a pickup code, but the implementation actually navigates to an order page and clicks order/confirmation controls to place a live order. This mismatch is dangerous because operators may run the skill believing it is read-only when it performs a state-changing purchase action.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill accepts environment-controlled service endpoints and credentials, including switching to arbitrary base URLs via environment variables, with no allowlist or provenance checks. In a hostile runtime, this can silently redirect identity and API-key-bearing requests to attacker-controlled infrastructure and exfiltrate secrets.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code can place real remote orders by sending authenticated purchase requests and then proceeding into browser-driven fulfillment flows. In the context of an agent skill, that is a high-consequence action because it can spend funds or consume account balances without a strong in-band confirmation model beyond command-line flags.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill persists local order history, including order URLs, IDs, product metadata, and timestamps, then provides enumeration and lookup features. If the local machine is shared or compromised, these files may expose purchase links and behavioral history without any access control or retention limits.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill orchestrates multiple helper scripts that can drive browser automation and potentially complete purchases. In this context, subprocess-based orchestration materially increases capability and risk because it expands the trusted code surface and enables unattended real-world transactions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly instructs users to place phone numbers and API keys in a local `.env` file and shows concrete variable names and example values, but it does not pair this with clear guidance on secure storage, rotation, least privilege, or avoiding accidental disclosure. In a skill intended for automated purchase flows, normalizing credential handling without security warnings increases the chance that secrets are mishandled, copied into logs, or committed to repositories.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: These sections describe browser automation that proceeds through concrete purchase-confirmation steps for KFC and McDonald's order flows, including clicking final order buttons and obtaining pickup codes. Although the file mentions stopping before final submit by default elsewhere, the detailed operational guidance for real ordering is not preceded by a prominent, unavoidable warning that this can trigger real purchases and charges if `--allow-final-submit` is enabled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script accepts a URL and proceeds through an automated purchase flow that can submit an order with only a command-line flag to stop before final confirmation. In an agent or automation context, this creates a real unauthorized-action risk because it can trigger a real-world financial transaction without a clear, user-facing consent checkpoint tied to the specific order details.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The script stores screenshots, order numbers, pickup codes, and the full input URL to disk in a local outputs directory. Those artifacts may contain sensitive purchase data or tokens embedded in the URL, and can be exposed to other local users, logs, backups, or downstream tooling without the user's awareness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code performs UI automation that clicks the final confirmation controls and repeatedly reloads until the post-submission task page appears, which is behavior consistent with actually placing a live order. In a skill/agent setting, automating a purchase without a strong affirmative consent gate can cause unauthorized charges, fraudulent orders, or operational abuse.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The script creates an outputs directory and later stores screenshots, page text-derived details, order numbers, and pickup codes to disk. These artifacts may contain sensitive transactional data and location/order information, creating privacy and unauthorized disclosure risks if the host is shared or logs are collected centrally.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code proceeds from clicking an order button to confirming the purchase without any explicit user-facing warning, review step, or confirmation of cost and consequences. This creates a real risk of unauthorized or unintended transactions, especially in an automation context where users may not see the page state before submission.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The browser context is created with geolocation permission already enabled, bypassing any meaningful user disclosure or consent. Granting a sensitive permission automatically is unsafe because it conditions users to hidden collection or use of location-related data and may expand the page's access beyond what is necessary.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script saves screenshots and structured result files to disk, and those artifacts may contain order details, URLs, pickup codes, or other sensitive transactional information. Persisting such data without clear disclosure or retention controls increases the risk of local data leakage, unintended sharing, or later misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This script programmatically clicks order-confirmation controls and completes a McDonald's order flow using a supplied URL, then persists order details and screenshots to disk. In an agent setting, that creates a real-world transactional risk because a crafted or mistaken invocation can place an unwanted order without an explicit, user-visible confirmation checkpoint immediately before submission.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code transmits identity values and an API key to backend endpoints without any in-band disclosure or consent mechanism in this file. In a skill setting, hidden credential transmission is sensitive because users may not realize their identifiers and secrets are being sent to a remote service, especially when endpoints are environment-configurable.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Order details and URLs are written to local disk with no explicit warning, opt-in, or protection mechanism. These records can reveal sensitive purchase links and account activity to other local users, backup systems, or malware.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill can proceed from authenticated order creation into subprocess-driven browser automation that may perform final submission when --allow-final-submit is present, but there is no strong user-facing confirmation at the moment of execution. In an agent context, that creates a meaningful risk of unintended purchases or misuse of account balances.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the caller/model to parse prior stdout for `OPENCLAW_FINAL_LINK:` and to surface that link directly to the user, while also storing local order state containing order URLs and related sensitive data. This creates a disclosure path where sensitive order links can be exposed through logs, chat transcripts, or local state enumeration, especially if stdout or the local state directory is accessible to other users or tools on the host.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
playwright>=1.52.0

• Confidence: 95% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
playwright>=1.52.0

• Confidence: 95% confidence
• Finding: playwright>=1.52.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: requests

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.