T09 · Insecure Skill Coding Practices
Error
- Location
scripts/config.sh:9- Finding
Credential Exfiltration Through Unrestricted API Endpoint Override
- Content
View full analysis
- Remediation
View remediation
Security audit
Cin7 Inventory
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Cin7 inventory tool, but it can change live business data and its credential configuration can be redirected to a non-Cin7 endpoint without validation.
Review before installing. Use only with Cin7 credentials that have the minimum needed permissions, keep any .env file private, verify that CIN7_API_URL is absent or points to the official Cin7 HTTPS API, and treat create/update/stock scripts as live production changes requiring explicit user approval.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
README.md:8- Finding
Unpinned Package Execution in Documented Installation Command
- Content
View full analysis
- Remediation
View remediation
install cin7-inventory ``` 2. Document the expected package registry and trusted publisher. 3. Where supported, verify package signatures, provenance attestations, and integrity hashes before execution. 4. Review the pinned version and its dependency tree before recommending it. 5. Avoid automatically moving users to newer versions; document a controlled upgrade and review process. 6. Consider installing the reviewed package from a lockfile-backed environment instead of resolving it dynamically during each installation. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update-order.sh:9- Finding
Unsafe JSON Construction in Sales Order Update
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 3. Add `jq` to the documented and declared runtime requirements if this approach is adopted. 4. Validate `ID` against Cin7's expected identifier syntax and length before constructing the request. 5. Reject duplicate or conflicting ID semantics according to a defined policy; for example, always overwrite any supplied `ID` with the separately validated command-line ID. 6. Add tests covering quotes, backslashes, ampersands, newlines, empty objects, arrays, scalar JSON values, and malformed input. 7. Enable stricter Bash behavior, such as `set -euo pipefail`, after verifying that all scripts handle expected failures correctly. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh #!/bin/bash # Shared config for Cin7 Core API scripts # Sources .env from the project root SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh #!/bin/bash # Shared config for Cin7 Core API scripts # Sources .env from the project root SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" ENV_FILE="$SKILL_DIR/.env" if [ -f "$ENV_FILE" ]; then # Read .env safely, stripping any Windows \r characters
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx clawhub install cin7-inventorywithout pinning a specific package version. This allows whatever version is current at install time to be fetched and executed, which creates a supply-chain risk if the package is later compromised, replaced, or updated with malicious code. Because this skill handles inventory operations and expects API credentials, compromise could expose secrets or enable unauthorized business actions.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill exposes shell-based operational capabilities but does not declare any explicit tool scope such as allowed-tools or permissions. That weakens policy enforcement and reviewability, making it easier for an agent to invoke shell actions more broadly than intended when handling sensitive inventory workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation includes live state-changing operations such as stock adjustments, transfers, and order creation/update without any warning, confirmation requirement, or safe-use guidance. In an inventory-management context, these actions can directly alter business records, stock counts, and fulfillment state, increasing the risk of accidental or unauthorized modifications to production data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This shell script reads API credentials from a local .env file and exports them for later use, then uses those credentials in outbound curl requests. Although comments describe the mechanics, there is no user-facing warning, confirmation, or disclosure that sensitive environment data will be accessed and sent to an external API.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh cin7_get() { local endpoint="$1" shift curl -s -f \ -H "api-auth-accountid: $CIN7_ACCOUNT_ID" \ -H "api-auth-applicationkey: $CIN7_APP_KEY" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script sends the provided sales-order JSON via
cin7_post, which is a network operation affecting external systems. While the file has a brief usage comment, it does not include any confirmation, user-facing notice, or explicit warning that executing the script will submit data to a remote service.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill lists required API credentials but provides no warning that they are sensitive secrets that must not be logged, hardcoded, or echoed in outputs. In a shell-based skill, omission of this guidance increases the chance of credential leakage through command history, debugging, transcripts, or misconfigured environments.
- Content
Static analysis
No suspicious patterns detected.