Security audit

Sanmar

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims for SanMar ordering, but it can expose SanMar credentials through normal tool inputs and purchase-order preview/output.

Install only if you are comfortable giving the skill access to SanMar account credentials and purchase-order authority. Prefer environment or a managed secret channel over inline chat/JSON credentials, avoid sharing command transcripts, and do not use purchase-order dry runs or raw outputs in places where credentials may be logged until payload redaction is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill documentation declares no explicit permissions, yet it clearly describes capabilities that access environment secrets, read local files, and perform outbound network/SFTP requests. This creates a real security governance gap: an agent or reviewer may treat the skill as lower risk than it actually is, even though it can handle credentials, parse arbitrary local PDFs, and submit purchase orders to external systems.

Context-Inappropriate Capability

Low

Confidence: 86% confidence
Finding: The client can silently source SanMar credentials from process environment variables when explicit user-supplied credentials are absent. In an agent setting, that expands authority beyond the declared user-driven workflow and can cause the skill to access a tenant's stored secrets without an explicit, per-request user action.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document explicitly permits supplying SanMar credentials either through environment variables or inline stdin JSON, but provides no handling guidance for secrets in logs, shell history, process capture, transcripts, or downstream tool telemetry. In an agent/tooling context, inline JSON is especially risky because credentials may be persisted in prompts, traces, audit logs, or error output, increasing the chance of credential disclosure and subsequent unauthorized access to ordering, pricing, or customer account data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The examples explicitly instruct operators to pass SanMar credentials in stdin JSON, which creates a realistic path for secrets to be exposed through shell history, process inspection, logging, transcripts, debugging output, or copied command snippets. In a skill meant to be used by agents and humans, documentation strongly shapes behavior, so unsafe examples materially increase the chance of credential leakage.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill tells the agent to ask the user for credentials and then place them into tool input or environment variables, creating a natural-language workflow for collecting, handling, and retransmitting secrets. This is especially dangerous in an agent context because prompts, tool inputs, conversation logs, and telemetry may persist those credentials, turning ordinary use into secret exfiltration or long-term exposure risk.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The module explicitly supports passing raw customer numbers, usernames, passwords, and FTP passwords as plain string tool arguments for every LLM-facing call. In an agent setting, tool arguments are commonly visible to the model, may be logged in traces, and can be echoed in error handling or telemetry, so repeatedly transmitting secrets through this interface materially increases the chance of credential disclosure.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The helper documentation normalizes a pattern where the agent is instructed to pass plaintext credentials on every invocation, and the code constructs typed credential objects directly from those raw strings. That design institutionalizes repeated secret exposure across multiple calls, increasing the blast radius from prompt leakage, tool-call inspection, debugging logs, and observability systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/ftp_resolver.py:161