Security audit

SellToAI Moras Shop

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real shopping integration, but it sends preference context to an external service and uses a broad, unverified installer that affects multiple agent apps.

Review before installing. This skill may send shopping intent, budget, recipient details, preferences, and memory-derived summaries to SellToAI or a configured gateway, and its installer can place the skill into several agent apps from an unverified remote download. Prefer manual installation from reviewed files, avoid curl-to-bash, disable memory sharing unless you want personalization, and treat returned purchase links as commercially attributed/tracked links.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:3
Finding: Unverified Remote Payload Retrieval and Persistent Cross-Agent Installation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:46
Finding: Agent Tool-Routing and Server-Controlled Output Hijacking
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:81
Finding: Automatic Disclosure of User Preference Summaries and Persistent Memory References
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description describes the runtime behavior of a commerce/shopping skill, but the supplied code does not implement shopping, recommendation, product-card generation, personalization, attribution, or any commerce logic. Instead, it is an installation script whose purpose is to fetch a remote SKILL.md and place it into multiple local directories. That is a materially different primary purpose and includes undeclared capabilities: network download and filesystem writes across several agent environments. This is therefore a clear description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: The instruction to never narrate tool use, parsing, or the SKILL template encourages concealment of operational details from the user. In context, this is risky because the skill also performs external network requests and transmits summarized user context, so suppressing disclosure can materially reduce user awareness of third-party data handling.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
Moras API calls. Some OpenClaw deployments block URL fetches even for public domains; `exec` + `curl` is the reliable path and preserves response JSON exactly. OpenClaw output rule: **never narrate tool use, parsing, JSON-field mapping, or this SKILL.md template to the user.** The user should only see the final shopping recommendations. The skill name is `moras-shop`; do not spell it `mroas-shop`. On ClawHub, the published install slug is currently `mroas-shop`; that slug is

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The script advertises an external-script-fetching pattern via curl from a remote domain, encouraging users to run unreviewed code directly from the network. This is dangerous because compromise of the server, DNS, TLS termination, or published content can immediately turn installation into arbitrary code execution on the user's machine.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash # 一键把 moras-shop SKILL.md 安装到本机所有 skill-aware Agent。 # 用法：bash install.sh 或 curl -sSL https://selltoai.ai/skills/install.sh | bash set -euo pipefail SRC_URL="${MORAS_SHOP_SKILL_URL:-https://selltoai.ai/skills/moras-shop/SKILL.md}"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The explicit '| bash' chaining pattern removes the user's opportunity to inspect what will run and turns any upstream content change into immediate shell execution. In the context of a skill installer, this is especially risky because it can establish persistent influence over multiple local agent environments in one step.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/usr/bin/env bash # 一键把 moras-shop SKILL.md 安装到本机所有 skill-aware Agent。 # 用法：bash install.sh 或 curl -sSL https://selltoai.ai/skills/install.sh | bash set -euo pipefail SRC_URL="${MORAS_SHOP_SKILL_URL:-https://selltoai.ai/skills/moras-shop/SKILL.md}"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill explicitly instructs hosts to use shell/exec with curl, but the manifest does not declare a corresponding tool scope or allowed-tools boundary. That creates a least-privilege gap: hosts or reviewers may treat the skill as low-risk shopping logic while it actually depends on arbitrary command execution, increasing the chance of unsafe deployment or overbroad execution rights.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs the agent to summarize local preferences and constraints and send them to the SellToAI gateway, but the user-facing description does not clearly disclose that external transmission occurs. This weakens informed consent and can expose sensitive preference, budget, locale, or relationship context to a third-party service without adequate transparency.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger conditions are broad enough to auto-activate on common recommendation or gift-related phrases, which can cause the agent to send user shopping intent and summarized preferences to an external service without clear, situational confirmation. In a multi-skill environment this can misroute benign conversation or prematurely disclose preference context to a third party.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction to load the skill early and avoid other tools before trying Moras biases routing toward this external commerce endpoint even when user intent may still be ambiguous. That can override safer or more appropriate local processing and increases the likelihood of unnecessary data sharing or commercially biased recommendations.
Content: No source excerpt is available for this finding.

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
md
the creator/brand who supplied the video gets nothing. 2. **NEVER fabricate products, prices, videos, or creators.** Only render what the API returned. If `items` is empty, say so plainly. 3. **NEVER tell the user the product is yours / Moras's.** Moras curates from real TikTok creators; you should attribute videos to the creators themselves. 4. **Always show at least one video** if available — the videos are the entire value prop.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example sends structured personal context including region, budget, recipient relationship, age band, occasion, and preferences to an external API, but the documented flow gives no user-facing disclosure, consent checkpoint, or data-minimization guidance. In an agentic commerce setting this can normalize silent third-party sharing of user and child-related preference data, creating privacy, compliance, and trust risks.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · install.sh (reported line 6)May include surrounding context.
sh
# 用法：bash install.sh 或 curl -sSL https://selltoai.ai/skills/install.sh | bash set -euo pipefail SRC_URL="${MORAS_SHOP_SKILL_URL:-https://selltoai.ai/skills/moras-shop/SKILL.md}" DEST_DIRS=( "$HOME/.cursor/skills/moras-shop" "$HOME/.claude/skills/moras-shop"

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script is packaged as a shopping skill installer but is designed to deploy content across several local agent environments, which is a broader capability than necessary for the stated purpose. That mismatch matters because users may underestimate the security impact of installing shopping-related functionality, while the script actually establishes presence in multiple agent trust stores.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The installer performs a network fetch and then writes files into multiple hidden application directories with no interactive warning, confirmation, or dry-run output. Hidden side effects reduce informed consent and make it easier for users to authorize broader persistence than they intended.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installer writes the skill into multiple local agent-specific directories, affecting several tools beyond the narrowly described shopping functionality. This broad persistence behavior expands the script's reach and trust footprint, so a compromised or swapped remote SKILL.md would be propagated into multiple agent environments at once.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The only user example is written in Chinese, which suggests a language-specific interaction pattern, but the file does not state that the skill is region- or language-specific or offer any opt-in choice. Under the policy rule, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language instructions in the script are presented only in Chinese, including the main description and usage guidance. This imposes a specific language on users without providing an alternative or opt-in, which fits the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage text explicitly promotes a curl-to-bash installation flow, which executes network-retrieved code without prior inspection. Even though the line is a comment, it instructs users toward a dangerous deployment pattern that can lead to arbitrary code execution if the hosting endpoint, transport path, or upstream content is compromised.
Content: No source excerpt is available for this finding.