Security audit
Security checks for vulnerabilities and agentic risk
The skill is a mostly coherent ZooData competitor-analysis integration, but it needs Review because its API key can be redirected to HTTP or localhost via an environment override and its install command is unpinned.
Install only if you trust the ZooData publisher and need Amazon competitor analysis using a ZooData API key. Avoid setting ZOODATA_BASE_URL; especially do not point it at HTTP, localhost, or unofficial hosts. Prefer a pinned install source or reviewed commit, and remember that scheduled monitoring stores local baseline/history data and consumes API credits on recurring runs.
scripts/zoodata.py:55Bearer API Key Can Be Sent over Plaintext HTTP or to an Untrusted Local Process
README.md:19Unpinned npx Installation Command Introduces Mutable Supply-Chain Execution
This second mismatch finding highlights that the skill claims two focused modes (Full Scan and Quick Check) but appears to expose broader keyword, market, brand, history, and self-check utilities, while the claimed monitoring/alerting behavior is only loosely specified in markdown. Such inconsistency weakens security review and can cause operators to rely on assurances about scope and behavior that are not actually enforced.
This second mismatch finding highlights that the skill claims two focused modes (Full Scan and Quick Check) but appears to expose broader keyword, market, brand, history, and self-check utilities, while the claimed monitoring/alerting behavior is only loosely specified in markdown. Such inconsistency weakens security review and can cause operators to rely on assurances about scope and behavior that are not actually enforced.
The install instruction uses npx skills add SerendipityOneInc/ZooData-Skills without pinning an exact package or version, so users may execute whatever package/version resolves at install time. That creates a supply-chain risk: a compromised upstream package, typosquat, or malicious new release could run arbitrary code on the user's machine during installation.
The skill declares significant capabilities (environment access, file reads, network, and shell execution) but does not expose an explicit tool-scope or permission boundary in the manifest. That creates a governance and least-privilege problem: an agent runtime may grant broader powers than users or reviewers expect, increasing the blast radius if the skill is misused, prompt-injected, or modified later.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ─── Configuration ───────────────────────────────────────────────────────────
DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ─── Configuration ───────────────────────────────────────────────────────────
DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ─── Configuration ───────────────────────────────────────────────────────────
DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61
The review prompt toolkit renders Map/Reduce prompts, ingests local JSON files, and aggregates caller-produced annotations into review insights. That is a generic review-analysis and prompt-engineering capability, not an obvious requirement for a skill whose stated purpose is competitor intelligence monitoring over a defined competitor set.
The review-tag prompt explicitly says 'Output must be in English — translate non-English text before extracting.' This hard-codes a language policy for downstream use without offering a user choice or documenting a justified locale restriction, which matches the natural-language policy violation criteria.
The manifest describes a skill focused on analysis of a defined competitor set, either as a one-shot teardown or sustained per-competitor monitoring. This file implements many additional workflows such as full market entry analysis, opportunity discovery, listing audits against category leaders, pricing analysis for the user's own ASIN, and standalone review intelligence, which materially broaden the skill beyond competitor-set-focused analysis.
The manifest promises competitor-focused insight keyed by competitor identifiers like ASINs, brands, or keywords identifying a competitor set. These commands provide standalone keyword snapshots, trend profiles, keyword expansion, SERP results, and traffic-term analytics, which are broader keyword-research capabilities rather than per-competitor teardown or monitoring.
The example prompt "Quick check my tracked competitors" is a short, generic phrase that could collide with ordinary user requests rather than clearly signaling a narrow skill invocation. The README provides examples, but it does not define explicit trigger boundaries or exclusion conditions to distinguish when this skill should activate versus when it should not.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"priceMin", "priceMax", "ratingMin", "ratingMax", "bsrMin", "bsrMax",
"salesGrowthRateMin", "salesGrowthRateMax", "sellerCountMin", "sellerCountMax",
"variantCountMin", "variantCountMax"):
val = getattr(args, attr.replace("Min", "_min").replace("Max", "_max")
.replace("monthly", "monthly_").replace("review", "review_")
.replace("sales", "sales_").replace("Growth", "_growth_")
.replace("Rate", "rate_").replace("price", "price_")
No suspicious patterns detected.