Security audit

purchasing-agent-guide

Security checks across malware telemetry and agentic risk

Overview

This skill is a real remote shopping MCP guide, but it needs review because it asks users to provide passwords in chat and supports USDT purchases through a third-party service.

Review this before installing. Only use it if you trust the remote MCP operator and understand that the agent may ask for a phone/email, password, order information, transaction hash, and USDT payment details. Do not reuse an important password, do not provide wallet seed phrases or unrelated secrets, verify the MCP domain and payment details yourself, and treat purchases as potentially non-refundable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The skill description is broad enough to activate on generic MCP connection or shopping-related requests, not just narrowly scoped purchasing flows. Over-broad invocation can cause the agent to enter this workflow unexpectedly and steer users into a high-risk commerce/payment process involving accounts, goods, and cryptocurrency before clearer intent validation occurs.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The intent parsing rules use very broad natural-language patterns that may match ambiguous user input and map it directly to sensitive actions such as sign-in, order lookup, refunds, payment verification, or message submission. In a commerce flow tied to account access and crypto payments, accidental or premature tool invocation can expose data, mis-handle session state, or advance a transaction without sufficiently precise confirmation.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The example explicitly asks the user to send a phone/email and password directly in chat, but does not clearly warn about credential sensitivity, storage, reuse risks, or recommend OAuth/device-link alternatives. In a shopping/MCP agent context, this normalizes credential collection by the agent and could lead to account compromise, credential reuse exposure, or insecure downstream handling by tools, logs, or operators.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase "逛逛商店" is broad and immediately initiates interaction with a remote shopping MCP without clearly restating scope, risk, or what data may be requested next. In a skill that can prompt for login credentials and facilitate purchases via USDT, a vague activation phrase increases the chance that users will enter a sensitive workflow without informed consent or clear boundaries.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide states that unauthenticated users will be prompted for phone/email and password, but it does not prominently warn users in advance that these credentials will be submitted to a remote third-party MCP endpoint. Because this skill is explicitly designed to connect users to an external service and handle shopping/payment flows, failing to disclose credential handling creates a significant phishing and credential-exposure risk.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.