amazon-market-trend-scanner

• Outcome: Review
• Latest audit: Aug 4, 2026 · 1:40 AM UTC
• Version: 1.0.7

Overview

This skill is a real Amazon trend-scanning integration, but it bundles a much broader ZooData command tool and preloaded monitoring state, so it should be reviewed before installing.

Install only if you are comfortable giving ZooData an API key and sending category, keyword, ASIN, marketplace, date, and filter data to its API. Before use, clear or inspect the bundled scan-data directory, and enable scheduled monitoring only for categories you intentionally choose.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill uses environment access, local file reads, and network access but does not declare permissions in a machine-enforceable way. That creates a transparency and policy-enforcement gap: a host may select or run the skill without clearly surfacing that it can access API keys, local state, and external services. In this context the behavior is expected for the skill’s function, but the undeclared capabilities still increase the chance of over-privileged execution and user surprise.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest presents the skill as a narrowly scoped market trend scanner, but the underlying shared CLI reportedly exposes many unrelated high-capability operations such as product, review, keyword, competitor, and monitoring workflows. This description-behavior mismatch is dangerous because routing and trust decisions may be based on the benign description while the skill can perform broader data collection, persistence, and external API activity than users expect. The risk is amplified by the instruction to execute a shared CLI for all API calls, which broadens reachable functionality behind a single skill surface.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The skill metadata says this is a category trend scanner, but the bundled script exposes many broader workflows including market entry, competitor war room, pricing, listing audit, opportunity discovery, and review intelligence. That scope expansion increases the accessible data flows and agent actions beyond user expectations, which is dangerous because a caller selecting this skill for narrow trend analysis may inadvertently trigger unrelated, more invasive capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The keyword intelligence and traffic-term endpoints analyze SERP behavior and ASIN keyword traffic, which materially exceeds the stated purpose of scanning category trends over time. In an agentic environment, this mismatch can cause overcollection and misuse of unrelated competitive intelligence under the cover of a narrower skill description.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script includes prompt-generation and aggregation tooling intended to drive external LLM-based review analysis, which is unrelated to a category trend scanner's declared scope. This broadens the operational surface by enabling secondary processing of review text and LLM-mediated transformations that users and orchestrators may not expect from the skill description.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The README instructs users to configure a third-party API key and describes external API usage, but it does not clearly disclose that user-provided category names, search terms, and derived market research inputs will be transmitted to ZooData. This is a real transparency and privacy issue because users may assume analysis happens locally or may unknowingly send commercially sensitive research queries to an external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

# ─── Configuration ───────────────────────────────────────────────────────────

DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2"
API_BASE_PATH = "/openapi/v2"
KEYWORD_DATE_RANGE_MAX_DAYS = 93
KEYWORD_TIMELINE_MAX_DAYS = 61

• Confidence: 89% confidence
• Finding: https://api.zoodata.ai/

Session Persistence

Medium

• Category: Rogue Agent

Content

### Local Interface Failure Output

For a terminal interface failure, respond in the user's language that the trend scan could not be completed, then list succeeded and failed endpoint identifiers and state that existing scan state remains unchanged. Do not emit trend signals, hot-category rankings, alerts, or write watchlists, history, or baselines. Keep control tokens, parameters, and retry logs internal unless diagnostics are requested.

## Input

• Confidence: 88% confidence
• Finding: write watchlists, history, or baselines. Keep control tokens, parameters, and retry logs internal unless diagnostics are requested. ## Input Tell the user: "Give me one or more categories to monitor

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.