drivethru-adidas-click

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 0.9.0

Overview

The skill is a coherent adidas B2B automation tool, but it needs Review because it can use live credentials, submit real purchase orders, and has under-scoped safeguards that could leak credentials or place orders unintentionally.

Install only for an authorized adidas Click account you are willing to let the agent operate. Before use, restrict the base URL to approved adidas hosts, require literal JSON true for order submission, avoid inline or CLI passwords when possible, run under an unprivileged isolated account, review the anti-bot automation risk against your adidas terms, and keep screenshots in a private controlled directory or disable them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/adidas_client.py:80

Finding

Unrestricted Base URL Allows Portal Credential Exfiltration

Content

View full analysis

AdidasClickCredentials: if username or password: # Inline creds take precedence; fall back to env for base_url only. return AdidasClickCredentials( username=username or "", password=password or "", base_url=base_url or _env_base_url(), ) return credentials_from_env() ``` ```python # scripts/adidas_browser.py:790-792 def __init__(self, page: "Page", base_url: str) -> None: self.page = page self.base_url = base_url.rstrip("/") ``` ```python # scripts/adidas_browser.py:951-957 self.page.goto(self.base_url + _LOGIN_PATH, wait_until="domcontentloaded") try: self.page.wait_for_selector("#loginFormDsk", timeout=_DEFAULT_TIMEOUT_MS) self.page.fill("#usernameField", credentials.username) self.page.fill("#passwordField", credentials.password) # Leave "Remember me" (#form-reminder) unchecked. self.page.click("#send2Dsk") ``` ### Technical Analysis The Skill permits `base_url` to be supplied through an environment variable, standard input JSON, or a command-line flag. The value is used without URL normalization, HTTPS enforcement, hostname allowlisting, port restrictions, or verification that the final page remains on an approved adidas origin. The browser navigates to `${base_url}/login`, locates expected form s ...[truncated 1676 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/adidas_browser.py:2668

Finding

Non-Boolean Confirmation Values Can Submit Real Purchase Orders

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/adidas_browser.py:303

Finding

Runtime Browser and System Dependency Installation Expands the Supply-Chain and Privilege Surface

Content

View full analysis

=1.40 ``` ```python # scripts/adidas_browser.py:284-287 def _run_playwright(*args: str) -> None: """Run ``python -m playwright ``, raising on non-zero exit.""" subprocess.run([sys.executable, "-m", "playwright", *args], check=True) ``` ```python # scripts/adidas_browser.py:303-337 def _launch_chromium(playwright, headless: bool): """Launch Chromium, self-healing a missing binary or (best-effort) OS deps. The Playwright *package* is a declared dependency, but its Chromium *binary* is a separate ~150 MB download that pip/uv doesn't fetch, and the browser also needs OS-level shared libraries. There is no OpenClaw install-time hook for either, so on the first run we try to install the binary (and, if the launch fails on missing shared libraries, the system deps — which needs root) and retry. If the host still lacks the libraries, we raise a precise, actionable error rather than a raw stack trace. """ try: return playwright.chromium.launch(headless=headless, args=_STEALTH_LAUNCH_ARGS) except Exception as exc: # noqa: BLE001 message = str(exc).lower() if not (_missing_binary(message) or _missing_system_libs(message)): raise AdidasConfigError( f"Could not launch a Chromium browser for Playwright " f"(underlying error: {exc})." ...[truncated 3171 chars]

Remediation

View remediation

=1.40`. 2. Use a lockfile and verify package hashes during installation. 3. Pin the corresponding Chromium revision and verify its integrity. 4. Install Playwright, Chromium, and operating-system libraries during a controlled image-build or deployment phase. 5. Remove automatic `playwright install-deps` execution from normal Skill operations. 6. If dependencies are absent, fail closed with a configuration error rather than changing the host. 7. Run the Skill under a dedicated unprivileged account without package-manager or root permissions. 8. Use a read-only base filesystem where feasible and isolate the browser in a container or sandbox. 9. Restrict outbound network access to approved adidas endpoints during normal operation; allow dependency repositories only in the controlled build environment. 10. Maintain a software bill of materials and periodically audit pinned Playwright and Chromium versions for known vulnerabilities. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/adidas_browser.py:2444

Finding

Caller-Controlled Screenshot Path Enables Arbitrary Writable-File Overwrite and Sensitive-Data Persistence

Content

View full analysis

None: try: self.page.screenshot(path=path, full_page=True) except Exception as exc: # noqa: BLE001 logger.warning("Could not capture screenshot at %s: %s", path, exc) ``` ```python # scripts/adidas_browser.py:2664-2666 if screenshot_path: driver.screenshot(screenshot_path) result.screenshot_path = screenshot_path ``` ```python # scripts/adidas_tools.py:244-248 result = _create( request=request, credentials=credentials, confirm=confirm, screenshot_path=screenshot_path, headless=headless, ) ``` ### Technical Analysis The screenshot path is supplied directly by the caller and passed to Playwright without normalization, directory restriction, extension validation, symlink protection, or an existing-file check. Playwright writes PNG content to that path. Any file writable by the Skill process can potentially be replaced with screenshot data. Although the screenshot is not executable code, overwriting configuration, state, or application files can cause denial of service or data corruption. The screenshots are taken from authenticated portal pages and may contain wholesale pricing, purchase-order information, customer names and delivery addresses, shipment details, tracking numbers, or other account data. The files are left on disk without explicit restrictive permissions, retention limits, or automatic cleanup. ### Attack Path 1. A caller supplies an absolute path or traversal path through `screenshot_path`. 2. The Skill authenticates to adidas Click and reaches a page containing sen ...[truncated 1083 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 433)May include surrounding context.

md

``carrier`` is adidas's raw carrier code as shown ("UPSN"); ``carrier_name``
    is the human carrier derived from the tracking URL's host (UPS, FedEx, ...)
    or None when the host is unrecognized. The delivery note's PDF download link
    is deliberately **not** captured — its URL embeds a bearer access token.
    """

    delivery_note: str | None = None

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/schemas.py (reported line 275)May include surrounding context.

python

``carrier`` is adidas's raw carrier code as shown ("UPSN"); ``carrier_name``
    is the human carrier derived from the tracking URL's host (UPS, FedEx, ...)
    or None when the host is unrecognized. The delivery note's PDF download link
    is deliberately **not** captured — its URL embeds a bearer access token.
    """

    delivery_note: str | None = None

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly supports environment-variable access, browser/network access, and shell execution, but it does not declare any tool scope restrictions such as permissions or allowed-tools. In a skill that can log into a third-party portal, place real orders, and handle credentials, the absence of explicit least-privilege boundaries increases the blast radius if the skill is misused, modified, or invoked in an unexpected context.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

**Agent guidance:** if the user's request pre-authorizes a choice, set the flag
and skip the pause — e.g. *"go ahead and order anything out of stock"* →
`on_insufficient_stock: "order"`; *"remove any out-of-stock items without
asking"* → `on_insufficient_stock: "skip"`. Otherwise leave it at `pause`; on a
`needs_confirmation` result, **message the user** with the `out_of_stock` details
and the three choices, wait for their answer, then resume:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The notes explicitly allow the agent to infer order-affecting behavior from broad natural-language phrases such as pre-authorizing out-of-stock handling. In a live, no-sandbox purchasing workflow, ambiguous prompt interpretation can convert an informational request into a real commercial action, causing unauthorized or unintended orders, substitutions, or backorders without a fresh explicit confirmation step.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/adidas_browser.py (reported line 287)May include surrounding context.

python

def _run_playwright(*args: str) -> None:
    """Run ``python -m playwright <args>``, raising on non-zero exit."""

    subprocess.run([sys.executable, "-m", "playwright", *args], check=True)


def _missing_binary(message: str) -> bool:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/adidas_browser.py (reported line 407)May include surrounding context.

python

)
    read_fd, write_fd = os.pipe()
    try:
        proc = subprocess.Popen(
            [xvfb, "-displayfd", str(write_fd),
             "-screen", "0", "1440x900x24", "-nolisten", "tcp"],
            pass_fds=(write_fd,),

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code explicitly configures the browser to evade anti-bot detection, including presenting a normal desktop fingerprint and avoiding automation markers to get past Akamai protections. That goes beyond ordinary browser automation and crosses into stealth behavior that may violate the target service's access controls and terms, increasing legal, operational, and account-lockout risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/adidas_browser.py (reported line 1510)May include surrounding context.

python

return "not_found", f"the portal redirected off the product page (to {url})"
        return (
            "unresolved",
            "the product page never rendered a size table (no confirmation "
            "either way that the style exists)",
        )

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/adidas_browser.py (reported line 2153)May include surrounding context.

python

for row in new:
                found[row["order_number"]] = row
            # Stop on a short page (last one), or when a page repeats what we
            # already have (the portal ignoring `page` must not loop forever).
            if len(rows) < _ORDER_BOOK_PAGE_SIZE or not new:
                break

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script deliberately modifies the JavaScript environment to hide navigator.webdriver, which is a classic automation-evasion technique. This is dangerous because it is designed to defeat bot-detection mechanisms, potentially bypassing the service's protective controls and exposing the operator to account suspension, blocking, or claims of unauthorized access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The document instructs use of live portal credentials via ADIDAS_CLICK_USERNAME and ADIDAS_CLICK_PASSWORD, but it does not include an explicit warning to users that the skill accesses sensitive authentication data. Because this markdown file describes operational behavior for a live purchasing system, a brief disclosure about credential handling would improve safety transparency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Playwright browser context is created with locale="en-US", which hard-codes a specific locale for all runs. This is a natural-language policy concern because the skill does not offer user opt-in or explain that the locale restriction is required for a region-specific workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.