Security audit

drivethru-sanmar

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent SanMar integration, but it needs Review because it handles live vendor credentials and order actions, and some outputs can expose passwords in raw SOAP payloads.

Install only for agents that genuinely need SanMar account access. Prefer environment or a secret store over inline JSON, avoid sharing raw command/output logs, and review PO submission carefully because confirm=true can place live orders. The publisher should redact credentials from raw_payload/raw_response before approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no explicit permissions while its documented behavior clearly requires access to environment secrets, local files, and external network services. This creates a governance and least-privilege gap: reviewers and runtimes may not understand or constrain the skill's actual access, increasing the risk of overbroad execution and secret exposure if the skill is misused or compromised.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file explicitly allows credentials to be passed inline via tool stdin JSON, which increases the chance that secrets will be logged, echoed in traces, stored in transcripts, or exposed through debugging and telemetry paths. In this skill context, the risk is heightened because the tooling handles live order, invoice, and account operations against a production supplier integration, so credential exposure could enable unauthorized access to SanMar web services or SFTP feeds.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The notes explicitly reference live portal credentials via environment variables for a browser automation flow against a production customer portal, but they do not give clear guidance on secure handling, storage, scoping, or redaction of those credentials. In a skill that may be operated, debugged, or extended by others, this increases the chance of credential leakage through logs, screenshots, copied notes, or misuse of production accounts.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The document describes a real return-submission workflow against a live portal and notes there is no sandbox, but the warning is buried in implementation notes rather than presented as a prominent safety warning at the start. That makes accidental irreversible actions more likely during testing, capture, or future implementation work, especially because the document also discusses how to finish final submission automation.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to ask users for SanMar credentials and then pass them inline in JSON or via environment variables. This creates a credential-handling and secret-exposure risk because user passwords may be collected unnecessarily, echoed in prompts, logged in shell history, captured in tool telemetry, or leaked to downstream processes; inline JSON is especially risky because examples normalize placing secrets directly in command input.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.