T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/shopify_bulk_upload.py:104- Finding
Unrestricted Image URLs Enable Blind Server-Side Request Forgery
- Content
View full analysis
- Remediation
View remediation
Security audit
Shopify Bulk Upload
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real Shopify bulk uploader, but it can change live store data at scale and has avoidable token and network-safety risks users should review before installing.
Review carefully before installing or running. Use a development Shopify store first, back up catalog data, use the smallest possible API scopes, keep the token out of command-line history when possible, verify the store URL is exactly your HTTPS myshopify.com host, and only process trusted product files and image URLs. Consider pinning dependencies and adding an explicit confirmation prompt before production uploads.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/shopify_bulk_upload.py:47- Finding
Unvalidated Shopify Store URL Can Disclose the Admin API Access Token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
SHOPIFY_API_VERSION=2024-01
text To get Access Token: 1. Login to Shopify Admin 2. Go to Settings → Apps and sales channels → Develop apps 3. Create App → Configure Admin API scopes
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
SHOPIFY_API_VERSION=2024-01
text To get Access Token: 1. Login to Shopify Admin 2. Go to Settings → Apps and sales channels → Develop apps 3. Create App → Configure Admin API scopes
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python SHOPIFY_API_VERSION=2024-01 ``` To get Access Token: 1. Login to Shopify Admin 2. Go to Settings → Apps and sales channels → Develop apps 3. Create App → Configure Admin API scopes
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly performs bulk product and inventory writes to a Shopify store, but the description does not warn users that it can modify live store data at scale. In this context, omission of a clear warning increases the risk of accidental destructive or unintended changes to products, pricing, and inventory in production.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file documents create, update, and delete product endpoints, plus inventory-setting operations, but provides no user warning that these actions modify or remove live store data. Under the markdown-file criteria, descriptions that enable changes affecting user data or system integrity should disclose those risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code performs safety-relevant operations by creating products through the Shopify API and writing upload results to local JSON files. While progress is logged, there is no clear user-facing warning or confirmation that running the script will change store data and create output artifacts on disk.
- Content
Cloud Storage Exfiltration
Medium
- Category
- Data Exfiltration
- Confidence
- 55% confidence
- Finding
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
- Content
python # 创建上传器并执行 uploader = ShopifyUploader(args.store, args.token) uploader.upload_from_file(file_path) if __name__ == "__main__":
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This CSV template includes example product titles and descriptions only in Chinese, which can amount to a fixed language choice in user-facing template content. The file does not indicate that Chinese is optional, configurable, or required for a region-specific purpose.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a lower bound only, which allows installs to float to different future versions and undermines reproducible builds. This increases supply-chain risk because a later vulnerable or malicious release could be resolved without any manifest change.
- Content
text pandas>=2.0.0 requests>=2.28.0 python-dotenv>=1.0.0 openpyxl>=3.1.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
Because pandas is not pinned, it is impossible to verify from this manifest whether the installed version avoids known advisories. Even though the cited CVE is disputed and may not affect current versions, the lack of version certainty is itself a supply-chain weakness.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The requests package is unpinned, so dependency resolution may select different versions across environments or over time. That weakens build integrity and can expose deployments to newly introduced vulnerable releases or breaking changes.
- Content
text pandas>=2.0.0 requests>=2.28.0 python-dotenv>=1.0.0 openpyxl>=3.1.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Requests has multiple historical advisories, and the manifest does not identify which version will actually be installed. Since this library commonly handles outbound HTTP and credentials, version ambiguity can increase the chance of deploying a release with known security flaws.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Using python-dotenv with only a minimum version permits uncontrolled upgrades to later releases. This creates avoidable supply-chain uncertainty and may pull in a version affected by newly disclosed issues.
- Content
text pandas>=2.0.0 requests>=2.28.0 python-dotenv>=1.0.0 openpyxl>=3.1.0
Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
The manifest does not pin python-dotenv, so it cannot be confirmed whether deployed environments use a version affected by known issues. While impact depends on how the package is used, the uncertainty is avoidable and weakens dependency hygiene.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The openpyxl dependency is not pinned to an exact version, so builds are not reproducible and future installs may silently change behavior or security posture. In a package used to process spreadsheet files, drift can be especially undesirable if parser-related flaws are later introduced.
- Content
text pandas>=2.0.0 requests>=2.28.0 python-dotenv>=1.0.0 openpyxl>=3.1.0
Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
Openpyxl has had XML-related security advisories, and the unpinned requirement makes it unclear whether a safe version will be installed. In contexts where spreadsheets may come from external or untrusted sources, this uncertainty is more dangerous because parser flaws can be reachable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Natural-language text in the module docstring and subsequent user-facing messages is presented only in Chinese, which imposes a specific language choice on users. There is no indication that the tool is region-specific or that users can opt into this locale.
- Content