Security audit

Inventory Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a sample inventory tool, but it overstates live e-commerce capabilities and has under-scoped operational and install guidance.

Review this carefully before installing. Treat it as a demo or scaffold unless the publisher clearly documents and implements real Taobao/Douyin integrations, safe sync controls, dry-run behavior, version-pinned installation, and privacy handling for alerts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:16
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation
install yinan-inventory-manager ``` 2. Document the expected package registry, publisher identity, and reviewed version so users can detect unexpected resolution sources. 3. Verify the package artifact against a trusted integrity hash or signature before execution where the distribution system supports this. 4. Prefer installing dependencies through a committed lockfile and a reproducible package-management workflow rather than dynamically executing the latest registry release. 5. Review new versions before updating the documented version pin. 6. Advise users not to run the installation command with administrator or root privileges. 7. Consider using a locally installed, verified CLI binary and invoking that binary directly instead of allowing `npx` to fetch executable code on demand. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill description promises real inventory sync, supplier management, forecasting, and automated alerts, but the noted behavior indicates some of these capabilities are unimplemented, simulated, or overstated. In an operational e-commerce context, this can mislead users into trusting automations that do not actually protect stock accuracy or send alerts, causing business-impacting decisions based on false assumptions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx clawhub install yinan-inventory-manager without pinning a specific version of the package/tooling. This can cause users to fetch and execute whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or if a typosquatted/replaced package is served.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents commands that generate and write files such as CSV, Excel, forecast outputs, and purchase orders, yet it declares no explicit tool scope or permissions boundary. This creates an authorization and transparency gap: an agent or user may invoke file-writing behavior without clear policy constraints, increasing the chance of unintended file creation or overwriting in the execution environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The quick-start sync examples encourage cross-store inventory synchronization without warning that these operations may overwrite target inventory or propagate incorrect stock states. In a multi-store commerce setting, a mistaken sync can cause overselling, hidden listings, or large-scale inventory corruption across channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented conflict-resolution modes include destructive options like source_wins and target_wins, but there is no explicit warning about irreversible inventory changes if the wrong mode is chosen. Because this skill targets live storefront operations, unsafe defaults or misunderstood conflict settings could rapidly spread bad data between stores.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The alerting section describes sending inventory-related notifications through email and WeChat without warning that contact details and stock status may be transmitted to external services. This can expose business-sensitive inventory data or personal contact information if users enable notifications without understanding the data-sharing implications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.