drivethru-digitize-outsourcing

• Outcome: Review
• Latest audit: Sep 30, 2026 · 1:53 PM UTC
• Version: 0.5.3

Overview

The skill matches its embroidery outsourcing purpose, but needs review because one documented shell pattern can execute crafted job metadata while the skill has Odoo access and persistent job files.

Before installing, fix the manifest-writing instructions to use a real JSON serializer or a non-expanding heredoc with separately serialized values. Use a least-privilege Odoo MCP token, prefer staging as documented, confirm vendor submissions intentionally, and define retention/access controls for the persistent job archive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:284

Finding

Shell Command Injection Through Unquoted Manifest Heredoc

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:284-289; duplicated in references/routine.md:306-310
Vulnerability Type: Shell command injection through unsafe heredoc interpolation
Risk Level: Medium

Vulnerable Code

bash

cat > "$JOB/manifest.json" <<JSON
{"decoration_id": <DECO_ID>, "job_reference": "<DECO_ID>",
 "customer": "<customer>", "job_name": "<job_name>",
 "digitize_demand_id": <DEMAND_ID>, "artwork_lady_order_id": "<order # if known>",
 "date_filed_utc": "<UTC now>", "files": [{"filename": "...", "bytes": 0}]}
JSON

The reference documentation repeats the same unsafe construction:

bash

cat > "$JOB/manifest.json" <<JSON
{"decoration_id":4590,"job_reference":"4590","customer":"…","job_name":"…",
 "digitize_demand_id":812,"artwork_lady_order_id":"…","date_filed_utc":"$(date -u +%FT%TZ)",
 "files":[{"filename":"4590.DST","bytes":0},{"filename":"4590.pdf","bytes":0}]}
JSON

Technical Analysis

An unquoted shell heredoc delimiter such as <<JSON performs parameter expansion, command substitution, and arithmetic expansion within its body. The instructions direct the agent to insert customer names, job names, order identifiers, filenames, and other metadata obtained from Odoo or the external digitizing vendor into that body.

If an independently controlled metadata field is inserted verbatim and contains shell syntax such as $(command) or backticks, the shell executes that content before writing manifest.json. JSON quotation marks do not prevent shell expansion.

The vulnerability crosses a trust boundary because ERP or vendor-provided text is intended to be stored as JSON data but can instead be interpreted by the agent host's shell. The Python scripts themselves do not implement this vulnerable operation; the affected behavior is contained in the operational instructions that the agent is expected to execute.

Attack Path

1. An attacker able to influence ...[truncated 1324 chars]

Remediation

View remediation

Remediation Suggestions

• Do not generate JSON by interpolating external values into shell source.
• Use a JSON serializer, such as Python's json.dump, and pass values through structured input or environment variables rather than embedding them into executable shell text.
• Apply the same correction to both SKILL.md and references/routine.md.
• If a static heredoc is unavoidable, quote the delimiter as <<'JSON' so the shell performs no expansion. Dynamic values must then be added through a serializer rather than direct interpolation.
• Validate that the archive path is derived only from an expected numeric decoration identifier and treat customer names, job names, order identifiers, and filenames exclusively as data.
• Add a regression test using values containing $(...), backticks, quotation marks, newlines, and JSON metacharacters, verifying that they are serialized literally and never executed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a high-level, end-to-end embroidery digitizing automation workflow tightly scoped to BaconCo business objects and processes. The supplied code chunk is only a reusable infrastructure utility: a thin CLI wrapper around an MCP server that can list tools or invoke an arbitrary tool by name with JSON input. While this client could be used as a building block for the described workflow, it does not itself implement that workflow or any of the stated domain-specific actions. Therefore the actual behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad automation skill orchestrating outbound and inbound embroidery digitizing workflows across Odoo, an external digitizer skill, and persistent storage. The supplied code chunk is only a narrow supporting component: it parses worksheet PDFs and extracts structured metadata. While worksheet parsing is mentioned as one step of the declared return leg, this code by itself does not implement the primary described behavior, nor any of the external system interactions, triggers, or state changes. Therefore the code chunk's actual behavior is materially narrower and different from the declared purpose, making this a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares access to environment variables and an MCP-backed Odoo interface, but does not constrain tool scope with an explicit allowlist such as permissions or allowed-tools. In a skill that can read secrets and perform state-changing ERP operations, missing scope boundaries increases the blast radius if the skill is mis-invoked, prompt-injected, or later extended with unintended tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises broad trigger phrases like 'use whenever the user asks' across multiple common operational requests, which can cause over-selection of a high-impact automation that reads files, archives vendor returns, and changes Odoo record states. Overbroad invocation guidance is dangerous because it increases the chance the agent runs this workflow in contexts where the user only wanted information or a narrower action, leading to unintended external submissions or ERP transitions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The routine explicitly instructs the agent to retain vendor return packages on persistent local storage and make them retrievable later, while keeping them outside Odoo’s managed record system. Even if the files are business-relevant, this creates an unmanaged data store containing customer/job metadata and design files, increasing the risk of unauthorized access, over-retention, and data handling outside normal audit, access-control, and deletion workflows.

Content

No source excerpt is available for this finding.