Food402 - TGO Yemek

{
  "meta": {
    "document_id": "ssds:auto:food402:1.0.0",
    "ssds_version": "0.2.0",
    "scanner_version": "0.4.0+fe6fd9123d50",
    "created_at": "2026-03-05T11:27:32.400Z",
    "created_by": {
      "agent": "safeagentskills-cli/generate-ssds"
    },
    "language": "en",
    "notes": "Auto-generated SSDS. Manual review recommended."
  },
  "skill": {
    "name": "Food402 - TGO Yemek",
    "version": "1.0.0",
    "format": "agent_skill",
    "description": "Order food from TGO Yemek (Trendyol GO), Turkey's leading food delivery service. Use when user wants to order food delivery in Turkey, browse restaurants, search for foods, manage delivery addresses, check order history, or checkout with 3D Secure payment.",
    "publisher": "ClawHub",
    "source": {
      "channel": "clawhub",
      "slug": "food402",
      "owner": "rersozlu",
      "downloads": 1323,
      "stars": 0
    },
    "artifact": {
      "sha256": "52482c1f2bdc311c0c3d973026f8ed973755661985093815ade3fd1a85426364",
      "hash_method": "files_sorted"
    }
  },
  "capabilities": {
    "execution": {
      "can_exec_shell": true,
      "can_exec_code": false,
      "privilege_level": "user",
      "can_install_deps": false,
      "can_persist": true
    },
    "filesystem": {
      "reads_workspace": false,
      "reads_user_home": true,
      "reads_system": false,
      "writes_workspace": false,
      "writes_user_home": false,
      "writes_system": false,
      "can_delete": false
    },
    "network": {
      "egress": "any",
      "ingress": false
    },
    "credentials": {
      "reads_env_vars": false,
      "reads_credential_files": false,
      "reads_browser_data": true,
      "reads_keychain": false
    },
    "services": [],
    "actions": {
      "can_send_messages": false,
      "can_post_public": false,
      "can_purchase": false,
      "can_transfer_money": false,
      "can_deploy": false,
      "can_delete_external": false
    },
    "prompt_injection_surfaces": [
      "web"
    ],
    "content_types": [
      "general"
    ]
  },
  "hazards": {
    "hdac": {
      "H": 4,
      "D": 4,
      "A": 0,
      "C": 1
    },
    "flags": [
      "EXEC",
      "PERSISTENCE",
      "FS_READ_USER",
      "NET_EGRESS_ANY",
      "CREDS_BROWSER",
      "PI_WEB"
    ],
    "custom_flags": [
      {
        "code": "PERSISTENCE",
        "name": "Persistence Mechanism",
        "description": "Creates scheduled tasks or startup entries in: SKILL.md"
      },
      {
        "code": "TOOL_ABUSE",
        "name": "Unauthorized Tool Use",
        "description": "MCP_SYS_CRITICAL_ACCESS: Access to critical system directories"
      },
      {
        "code": "SOCIAL_ENGINEERING",
        "name": "Social Engineering Risk",
        "description": "SOCIAL_ENG_VAGUE_DESCRIPTION: Skill description is too vague or missing"
      },
      {
        "code": "COMMAND_INJECTION",
        "name": "Command Injection Risk",
        "description": "COMMAND_INJECTION_USER_INPUT: User input used in command substitution - potential injection risk"
      },
      {
        "code": "TOOL_POISONING",
        "name": "Tool Poisoning",
        "description": "Hidden secondary behavior detected: MCP_TOOL_POISONING_SENSITIVE_DATA"
      }
    ],
    "confidence": {
      "level": "medium",
      "basis": [
        "static_analysis"
      ],
      "notes": "Detected 5 security patterns (6 vendored rule hits). Review recommended."
    },
    "rationale": {
      "H": "H4: Critical: Privilege escalation or malware detected",
      "D": "D4: Critical: Credential theft or data exfiltration",
      "A": "A0: No side effects detected",
      "C": "C1: General content"
    }
  },
  "containment": {
    "level": "maximum",
    "required": [
      {
        "control": "SANDBOX_CONTAINER",
        "reason": "Code execution capability"
      }
    ],
    "recommended": [
      {
        "control": "LOG_ACTIONS",
        "reason": "Audit trail for all actions"
      }
    ],
    "uncontained_risk": "Risk level depends on manual review of actual capabilities."
  },
  "risks": {
    "risks": [
      {
        "risk": "Unauthorized tool use: MCP_SYS_CRITICAL_ACCESS",
        "severity": "high",
        "mitigation": "Avoid accessing system directories unless absolutely necessary."
      },
      {
        "risk": "Command injection risk: COMMAND_INJECTION_USER_INPUT",
        "severity": "medium",
        "mitigation": "Validate and sanitize all user inputs before using in commands"
      },
      {
        "risk": "Social engineering indicators: SOCIAL_ENG_VAGUE_DESCRIPTION",
        "severity": "low",
        "mitigation": "Provide clear, detailed description of skill functionality"
      },
      {
        "risk": "Tool poisoning: hidden behaviors detected (MCP_TOOL_POISONING_SENSITIVE_DATA)",
        "severity": "high",
        "mitigation": "Remove references to sensitive data collection."
      }
    ],
    "limitations": [
      "Static analysis only - runtime behavior not verified"
    ]
  },
  "incident_response": {
    "kill_switch": [
      "Stop the agent process"
    ],
    "containment": [
      "Review logs for unexpected actions"
    ],
    "recovery": [
      "Depends on skill capabilities"
    ]
  },
  "evidence": [
    {
      "evidence_id": "EV:file-1",
      "type": "file_excerpt",
      "title": "_meta.json",
      "file_path": "_meta.json"
    },
    {
      "evidence_id": "EV:file-2",
      "type": "file_excerpt",
      "title": "SKILL.md",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:file-3",
      "type": "file_excerpt",
      "title": "scripts/auth.sh",
      "file_path": "scripts/auth.sh"
    },
    {
      "evidence_id": "EV:file-4",
      "type": "file_excerpt",
      "title": "scripts/api.sh",
      "file_path": "scripts/api.sh"
    },
    {
      "evidence_id": "EV:file-5",
      "type": "file_excerpt",
      "title": "scripts/3dsecure.sh",
      "file_path": "scripts/3dsecure.sh"
    },
    {
      "evidence_id": "EV:cisco-1",
      "type": "file_excerpt",
      "title": "SOCIAL_ENG_VAGUE_DESCRIPTION [LOW] SKILL.md:1: ---",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:cisco-2",
      "type": "file_excerpt",
      "title": "MCP_TOOL_POISONING_SENSITIVE_DATA [HIGH] SKILL.md:51: 2. The script caches tokens in `/tmp/food402-token` with automatic refresh (60s ",
      "file_path": "SKILL.md"
    },
    {
      "evidence_id": "EV:cisco-3",
      "type": "file_excerpt",
      "title": "COMMAND_INJECTION_USER_INPUT [MEDIUM] scripts/auth.sh:45: csrf_token=$(echo \"$csrf_response\" | grep -o 'tgo-csrf-token[[:space:]]*[^[:spac",
      "file_path": "scripts/auth.sh"
    },
    {
      "evidence_id": "EV:cisco-4",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] scripts/auth.sh:1: #!/usr/bin/env bash",
      "file_path": "scripts/auth.sh"
    },
    {
      "evidence_id": "EV:cisco-5",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] scripts/api.sh:1: #!/usr/bin/env bash",
      "file_path": "scripts/api.sh"
    },
    {
      "evidence_id": "EV:cisco-6",
      "type": "file_excerpt",
      "title": "MCP_SYS_CRITICAL_ACCESS [HIGH] scripts/3dsecure.sh:1: #!/usr/bin/env bash",
      "file_path": "scripts/3dsecure.sh"
    }
  ]
}