Security audit

store-hopper

Security checks for vulnerabilities and agentic risk

Overview

This trip-planning skill is mostly coherent, but it uses under-disclosed web scraping, anti-bot tooling, third-party URL relays, location lookups, and persistent local updates that users should review before installing.

Install only if you are comfortable with the skill running Python scripts that query external search, weather, map, and page-extraction services. Avoid using home/work addresses or sensitive URLs unless the publisher narrows the fetch behavior, removes anti-bot/proxy relays or gates them with consent, and documents local file retention.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to execute local Python scripts that use shell, network access, environment variables, and file I/O, yet it declares no permissions or user-facing notice about those capabilities. This creates a covert capability mismatch: users may think they are getting a simple planning assistant while the skill can access external services and write local files during execution.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script explicitly advertises anti-bot circumvention and bypass of platform protections that go beyond a normal store-planning assistant's needs. This expands the skill's ability to access content from sites that intentionally restrict scraping, increasing legal, policy, and abuse risk and making the component more capable than its declared purpose suggests.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code is designed to relay user-supplied URLs through third-party proxy services, which shares request targets and retrieved content with external operators not implied by the skill's purpose. This creates data handling and privacy exposure, and may also be used to bypass site controls in ways users do not expect.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases are broad everyday requests like asking where to go or what to eat, which can cause the skill to activate in situations the user did not intend. Because the skill then performs external searches and routing workflows, unintended activation can lead to unnecessary data processing, network use, and confusion about why the agent is acting on the user's message.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow requires writing selected POI data to a JSON file as part of route planning, but it does not disclose this local persistence to the user or define retention/cleanup behavior. Even if the data seems low sensitivity, itineraries can reveal user interests, locations, and origin points, and silent file creation increases privacy and operational risk on shared systems.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The file instructs the agent to append newly discovered city codes directly to the markdown table, which turns a read-only reference file into mutable state. In an agent setting, this can enable persistent prompt/data poisoning, unreviewed file modification, and corruption of future runs if externally sourced search results are written back into the skill assets.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: At this point in the flow, the program automatically attempts proxy-based retrieval for arbitrary URLs without any visible warning, consent, or policy gate. Users may reasonably expect direct retrieval by the assistant, not transmission of targets and page contents to third-party services, making this a meaningful privacy and trust issue.

Static analysis

No suspicious patterns detected.