pp-shopper
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill documents an output delivery mechanism (
--deliver webhook:<url>) that can POST the results of any command to an external URL. This feature enables the exfiltration of sensitive data, such as account addresses (shopper-pp-cli address), delivery schedules, and purchase history, to any arbitrary destination. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
shopper-pp-cliandshopper-pp-mcpbinaries vianpxandgo installfrom the author's public repositories. While these are vendor-owned resources, they represent the execution of remote code during the setup process. - [CREDENTIALS_UNSAFE]: Users are instructed to manually extract a Bearer JWT token from browser developer tools and store it in an environment variable (
SHOPPER_TOKEN). This manual credential handling is prone to accidental exposure or misuse.
Audit Metadata