Security audit

amazon-opportunity-discoverer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it handles a paid API key with overly broad endpoint trust and a mutable install path that users should review before installing.

Review before installing. Pin the repository or release you install, avoid using ZOODATA_BASE_URL unless you fully trust the destination, and do not set it to HTTP or localhost with a production API key. Expect ZooData API calls to consume credits and confirm broad scans before running them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/zoodata.py:62
Finding: Bearer Credential Can Be Transmitted over Plaintext HTTP or to an Overly Broad Host Set
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:17
Finding: Installation Uses an Unpinned npm Launcher and Mutable Remote Repository
Content: View full analysis
Remediation: View remediation
add ... ``` 2. Pin the Skill repository to an immutable commit hash or signed release tag. 3. Publish a SHA-256 digest for the downloaded Skill artifact and require verification before installation. 4. Sign release artifacts and document signature verification using a recognized mechanism such as Sigstore or GPG. 5. Use npm lockfiles and integrity metadata for any packaged installer dependencies. 6. Audit and minimize npm lifecycle scripts. Avoid installation-time script execution where it is not strictly necessary. 7. Prefer a release archive from a controlled distribution channel over installation directly from a mutable repository branch. 8. Document the exact launcher version, repository commit, artifact checksum, and expected installed files so users can reproduce and verify the reviewed installation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A second description-behavior mismatch is present: the skill claims to use a defined opportunity-scanning flow, but the referenced tooling exposes broader keyword, competitor, review, and diagnostic capabilities. In context, this matters because the skill also handles an API key and local credential sources, so under-scoped descriptions can conceal a materially larger attack surface.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A second description-behavior mismatch is present: the skill claims to use a defined opportunity-scanning flow, but the referenced tooling exposes broader keyword, competitor, review, and diagnostic capabilities. In context, this matters because the skill also handles an API key and local credential sources, so under-scoped descriptions can conceal a materially larger attack surface.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for discovering what to sell via category scanning, candidate validation, and ranking, but this file implements a broad ZooData CLI surface including market-entry analysis, competitor war-room analysis, pricing analysis, daily monitoring, listing audits, review deep-dives, raw review export, and keyword intelligence workflows. Those operations go well beyond a ranked opportunity scanner and materially expand what the bundled code can do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest positions this skill as a niche/product opportunity finder for users without a target product, but these workflows accept my_asin, perform deep competitor analysis, pricing benchmarking, brand drill-down, and market benchmarks for existing products. Those are post-selection evaluation capabilities rather than discovery capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says to use another skill for tracking category trends over time, yet this file implements daily-radar for unattended daily monitoring of tracked ASINs with historical comparison, competitor detection, and review pulse. Persistent monitoring of known products is not justified by a discovery scanner whose purpose is to find new opportunities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly says this skill should be used to discover what to sell when the user has no specific target yet, and says evaluating a niche already named should use amazon-market-entry-analyzer instead. The listing-audit workflow accepts --my-asin and performs a benchmark audit of a specific product listing, which is a separate evaluation/audit capability not justified by the discovery-only purpose.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The installation command uses npx skills add SerendipityOneInc/ZooData-Skills without pinning a specific package or skill version, so users may fetch whatever version is current at execution time. That creates a supply-chain risk: if the upstream package, dependency chain, or referenced skill content is changed or compromised, users could install and run unexpected code or prompts.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises access to powerful capabilities (environment secrets, file reads, network, and shell) but does not declare an explicit tool/permission scope in the manifest. That weakens least-privilege controls and makes it easier for the skill to invoke sensitive operations beyond its stated purpose, especially since the document references a shared CLI, local config reads, temporary file handling, and network access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation phrases are broad enough that the skill may be selected for ordinary shopping or brainstorming requests that only loosely mention product ideas or what to sell. Unintended activation is risky here because the skill can consume paid API credits, access a secret API key, and trigger multi-call scans with network activity that the user may not have intended.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/reference.md (reported line 25)May include surrounding context.
md
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/zoodata.py (reported line 50)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/zoodata.py (reported line 87)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest mentions validating opportunities with brand analysis and price structure, but this file also ships a prompt-as-data review-analysis toolkit that fetches raw reviews, renders prompts for an external LLM workflow, and aggregates labeled outputs. That is a specialized review-intelligence subsystem and not an obvious requirement for a product opportunity discoverer as described.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The review-tagging prompt explicitly instructs the caller's LLM that output must be in English and to translate non-English text before extracting. This is a natural-language locale policy constraint applied unconditionally, with no user choice or documented region-specific justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example prompt "Run a quick scan and show me what opportunities are out there" is broad and lacks domain-specific constraints, making it resemble common conversational requests rather than a narrowly scoped skill trigger. The README does not provide explicit exclusion conditions or clarify when such a request should or should not invoke this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require responses to be in the user's language and state that output language must match the user's input language. This is a natural-language locale policy constraint with no explicit user choice or opt-in mechanism documented.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/zoodata.py (reported line 1234)May include surrounding context.
python
"priceMin", "priceMax", "ratingMin", "ratingMax", "bsrMin", "bsrMax", "salesGrowthRateMin", "salesGrowthRateMax", "sellerCountMin", "sellerCountMax", "variantCountMin", "variantCountMax"): val = getattr(args, attr.replace("Min", "_min").replace("Max", "_max") .replace("monthly", "monthly_").replace("review", "review_") .replace("sales", "sales_").replace("Growth", "_growth_") .replace("Rate", "rate_").replace("price", "price_")

Static analysis

No suspicious patterns detected.