mercadona-cli-shopping

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These are suspicious because they include a direct raw GitHub install script (curl | sh) and a GitHub repo from a likely small/unknown user (ivorpad)—a common and high-risk distribution method—while ara.so looks like the project/author site but does not mitigate the risk of running unreviewed remote scripts.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill is a Go CLI that fetches Mercadona catalog/pricing data from the website at runtime, and those HTTP responses are ingested as readable text/JSON by the agent for commands like search, product, categories, and total (public web content → outsider-authored free text/markup).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes an installation command that fetches and immediately executes a remote script (curl -fsSL https://raw.githubusercontent.com/ivorpad/mercadona-cli/main/install.sh | sh), which runs remote code during setup and therefore poses an execution risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill provides explicit shopping-cart and checkout APIs including authenticated cart management and a checkout "submit" command that "places real order (IRREVERSIBLE)". It extracts and stores refresh/access tokens and can auto-renew them, supports adding/setting cart quantities, creating a checkout, setting delivery details, reviewing totals, and finally submitting the checkout (with budget guards). Those capabilities are explicitly designed to complete real purchases (i.e., execute financial transactions), not merely generic browsing or HTTP requests.