Skill Dropshipping Fulfillment

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:07 AM UTC
• Version: 1.2.3

Overview

This skill performs plausible dropshipping fulfillment work, but it has under-disclosed live commerce actions, credential handling, and customer-data logging that users should review before installing.

Install only after reviewing the scripts and using test or least-privilege WooCommerce/CJ credentials. Treat live runs as capable of placing supplier orders, changing WooCommerce order state, adding order notes, changing product SKUs, storing CJ tokens, and writing customer data to local logs. Prefer fixing URL validation, dry-run side effects, PII redaction, live confirmation, and dependency updates before production use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fulfill.js:115

Finding

Unvalidated API origins can expose credentials, access tokens, and customer data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fulfill.js:238

Finding

Dry-run mode performs unnecessary CJ authentication and exposes the API key to avoidable network risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fulfill.js:288

Finding

Customer personally identifiable information is printed and retained in plaintext logs

Content

View full analysis

`); console.log(` Address: ${mapped.shippingAddress}, ${mapped.shippingCity}, ${mapped.shippingCountry} ${mapped.shippingZip}`); ``` The payload contains complete fulfillment details and is printed in dry-run mode: ```js const payload = { orderNumber: mapped.orderNumber, shippingZip: mapped.shippingZip, shippingCountry: mapped.shippingCountry, shippingCountryCode: mapped.shippingCountry, shippingProvince: mapped.shippingProvince, shippingCity: mapped.shippingCity, shippingAddress: mapped.shippingAddress, shippingPhone: mapped.shippingPhone, shippingCustomerName: mapped.shippingName, shippingEmail: mapped.shippingEmail, products: mapped.matched.map(p => ({ vid: p.vid, quantity: p.quantity })), }; if (DRY_RUN) { console.log(`\n 🔍 DRY RUN — would submit payload:`); console.log(' ' + JSON.stringify(payload, null, 2).split('\n').join('\n ')); submitted++; continue; } ``` The full payload is retained when CJ rejects an order: ```js } else { const errDetail = JSON.stringify(result).slice(0, 300); console.error(` ❌ CJ rejected: ${errDetail}`); appendLog({ orderId: mapped.orderId, status: 'failed', error: errDetail }); appendRejectionLog({ type: 'cj_api_rejection', orderId: mapped.orderId, reason: 'cj_api_returned_failure', evaluated: { payload, cjResponse: errDetail }, }); failed++; } ``` The rejection log is written without an explicit restrictive mode: ```js function appendRejectionLog(entry) { const existing = readJson(REJECTION_LOG_PATH) ...[truncated 2745 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A description-behavior mismatch is a serious security and safety issue here because the skill is presented as order-fulfillment automation, but the analysis indicates the underlying code performs different actions such as SKU backfilling and rebuilding local mappings instead of the declared order workflow. When a skill that touches commerce systems behaves differently than advertised, operators may authorize it under false assumptions, leading to unintended data modification, bad inventory mappings, or incorrect downstream fulfillment decisions.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

tch, it's logged to the rejection log and the order is skipped. Fix by running `rebuild-mapping.js` or adding the entry manually.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios 1.13.6, and the finding cites multiple published advisories including SSRF-related proxy bypass and prototype-pollution-assisted MITM/credential theft classes. In this skill, axios is the primary HTTP client used to fetch WooCommerce orders and submit them to CJ Dropshipping, so a vulnerable client library can directly affect authenticated outbound API traffic and any environment-based proxy behavior.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

form-data 4.0.5 is reported vulnerable to CRLF injection through unescaped multipart field names/filenames. If this skill or future extensions construct multipart requests using untrusted order, product, or supplier-derived values, an attacker may be able to tamper with request structure or smuggle unintended headers/content to downstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The package explicitly depends on axios 1.13.6, which the finding indicates is affected by multiple published advisories, including SSRF and prototype-pollution-related issues. This skill integrates with external WooCommerce and CJ Dropshipping endpoints, so a vulnerable HTTP client can materially increase risk of request manipulation, credential exposure, or abuse of network trust boundaries depending on how requests are constructed elsewhere in the skill.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fulfill.js (reported line 121)May include surrounding context.

js

const exp = Number(cfg.tokenExpiry || 0);
  if (cfg.accessToken && exp && now < exp - 10 * 60 * 1000) return cfg.accessToken;

  console.log('  🔑 Refreshing CJ access token...');
  const baseUrl = (cfg.baseUrl || 'https://developers.cjdropshipping.com/api2.0/v1').replace(/\/$/, '');
  const res = await axios.post(`${baseUrl}/authentication/getAccessToken`, { apiKey: cfg.apiKey }, {
    headers: { 'Content-Type': 'application/json' }, timeout: 30000,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill declares it requires Node but does not define an explicit tool/permission scope, while the documented behavior clearly relies on environment variables and file-based credentials. In an automation that can place external fulfillment orders and update WooCommerce state, missing scope declarations weakens operator understanding and runtime guardrails, increasing the chance of unintended access or execution with broader privileges than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill documentation does not prominently warn that running it may update live WooCommerce order statuses and place real CJ fulfillment orders, despite describing production-affecting actions. In this context, lack of an explicit warning makes accidental execution more dangerous because users may run the default command against live credentials without realizing it will create external orders and alter store records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code persists the refreshed CJ access token and expiry back into ./cj-api.json, which is a sensitive file write involving credentials. While the file header mentions the JSON fields, there is no user-facing confirmation, warning, or runtime disclosure that authentication material will be stored on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The createOrder function transmits shipping address, phone, customer name, and email to an external CJ API endpoint. The code contains no confirmation prompt, user-facing log, or warning comment indicating that personal data will be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code posts order data to CJ Dropshipping, and the payload later includes name, address, phone, and email for the customer. While the header comment says orders are submitted to CJ, it does not explicitly warn that customer personal data will be transmitted to a third-party service, and there is no confirmation prompt before live submission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a fulfillment skill that fetches processing orders, submits them to CJ Dropshipping, updates WooCommerce order status, and logs results. This script instead rebuilds product-to-supplier mappings and backfills product/variation SKUs in WooCommerce, which is catalog maintenance behavior rather than order fulfillment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The stated skill scope is order fulfillment and order-status updates, but these lines perform PUT requests to mutate WooCommerce product and variation SKUs. That is a materially different write capability than pushing orders to CJ and marking fulfillment progress.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The helper reads consumerKey and consumerSecret from ./woo-api.json and uses them for authenticated API access, but there is no user-facing log, prompt, or warning beyond a brief developer comment. This is a sensitive-credential access path, and the file does not disclose that secret material will be read and used for network authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The functions perform authenticated HTTP requests to retrieve and modify WooCommerce orders and notes, which can transmit business and customer-related data and make remote state changes. The file contains no confirmation prompt, user-facing logging, or warning text explaining these network and modification actions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because this skill likely makes authenticated requests to supplier and store APIs, a malicious or compromised upstream that triggers redirects could expose API keys or bearer tokens to an unintended domain.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a caret range, which allows automatic installation of newer minor/patch releases instead of a fully pinned version. In an automation skill that submits orders to external APIs, this weakens supply-chain reproducibility and can introduce unexpected or malicious upstream changes without code review.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "axios": "^1.13.6"
  }
}