Security audit

amazon-review-intelligence-extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed ZooData review-analysis integration, but it handles an API bearer key and untrusted review text in ways that deserve review before installation.

Review this carefully before installing if you will use a real ZooData API key. Prefer setting the key only in the environment, use a scoped/low-credit key if possible, avoid unpinned install commands, and treat fallback results based on raw reviews as potentially influenced by untrusted review text.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: scripts/zoodata.py:910
Finding: Untrusted Amazon Review Content Is Embedded Directly into Agent Instructions
Content: View full analysis
str: title = review.get("title") or "" body = review.get("body") or "" full = f"{title}. {body}" if title else body text = full[:500] rating = review.get("rating") or 3 verified = bool(review.get("verifiedPurchase")) return f"""IMPORTANT: Respond ONLY with a JSON object matching the schema below. Output must be in English — translate non-English text before extracting. You are an expert data extraction specialist analyzing product reviews. Extract only what is EXPLICITLY mentioned — do not infer. JSON schema: {{ "sentiment": "positive" | "neutral" | "negative", "mentioned_scenarios": [string], "mentioned_issues": [string], "mentioned_positives": [string], "mentioned_improvements": [string], "mentioned_buying_factors": [string], "mentioned_pain_points": [string], "user_profiles": [string], "mentioned_usage_times": [string], "mentioned_usage_locations": [string], "mentioned_behaviors": [string], "keywords": [string] }} Rules: - sentiment: positive (4-5 stars or praise), neutral (3 stars / mixed), negative (1-2 stars or complaint) - pain_points = problems EXPERIENCED AFTER USE. NOT problems the product solves. - issues vs pain_points: issues = product defects; pain_points = UX frustrations - user_profiles: include ONLY if the reviewer explicitly states an identity - consistent naming across reviews - use empty arrays [] for categories with no mentions, never null INPUT: Product Category: {product_category or '(unknown)'} Product Title: {product_title or '(unknown)'} Review Rating: {rating}/5 stars Verified Purchase: {'Yes' if verified else 'No'} Review Text: \"\"\ ...[truncated 2428 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/zoodata.py:330
Finding: Bearer Credential Is Not Protected Across Automatic HTTP Redirects
Content: View full analysis
dict: global _last_request_time url = f"{BASE_URL}/{endpoint}" if not BASE_URL_TRUSTED: print(f"ERROR: refusing to send your API key to untrusted host '{_host_of(BASE_URL)}'. " "Set ZOODATA_BASE_URL to a zoodata.ai host or localhost, or unset it.", file=sys.stderr) sys.exit(1) api_key = get_api_key() params = {k: v for k, v in params.items() if v is not None} for str_field in ("topN", "newProductPeriod"): if str_field in params and not isinstance(params[str_field], str): params[str_field] = str(params[str_field]) actual_params = dict(params) body = json.dumps(params).encode("utf-8") headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "User-Agent": "ZooData-CLI/1.0 (Python)", } now = time.monotonic() elapsed = now - _last_request_time if elapsed < MIN_REQUEST_INTERVAL: time.sleep(MIN_REQUEST_INTERVAL - elapsed) delay = RETRY_DELAY max_attempts = MAX_RETRIES for attempt in range(1, max(MAX_RETRIES, RATE_LIMIT_RETRIES) + 1): _last_request_time = time.monotonic() try: req = urllib.request.Request(url, data=body, headers=headers, method="POST") with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp: transport_status = getattr(resp, "status", None) if not isinstance(transport_status, int): transport_status = resp.getcode() response_body = resp.read() ``` ### Technical Analysis The implementation checks whether the initial `BASE_URL` belongs to a trusted hostname before constructing a re ...[truncated 1939 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:38
Finding: Installation Instructions Execute Unpinned Supply-Chain Components
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to use all 11 review endpoints for review intelligence, but the specification shows use of a broader CLI and a single review endpoint with client-side splitting plus local prompt/aggregation utilities. This creates deceptive capability signaling and can mislead operators about what data is collected, how results are produced, and what actions the skill may perform.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill claims to use all 11 review endpoints for review intelligence, but the specification shows use of a broader CLI and a single review endpoint with client-side splitting plus local prompt/aggregation utilities. This creates deceptive capability signaling and can mislead operators about what data is collected, how results are produced, and what actions the skill may perform.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as a review-intelligence extractor, but the bundled CLI exposes a much broader Amazon market-research surface including market-entry, competitor-analysis, pricing-analysis, listing-audit, opportunity-scan, keyword intelligence, and broad product discovery. This scope mismatch can enable unauthorized data access/workflows beyond user expectations and policy boundaries, especially if the allowlist manifest is absent, causing the code to default to full-surface exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to install the skill via npx skills add SerendipityOneInc/ZooData-Skills without pinning a specific version or immutable commit. This creates a supply-chain risk: users may fetch whatever package/version is current at install time, so a compromised publisher account, malicious update, or unexpected breaking change could deliver unreviewed code.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes meaningful capabilities—environment access, file reads, network access, and shell execution—without an explicit tool-scope declaration. That makes the trust boundary unclear and can lead to overbroad execution in hosts that rely on manifest-declared permissions, increasing the risk of unintended command execution or data access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to match many generic product-analysis requests, which can cause the skill to activate in contexts the user did not specifically intend. In a skill with shell, file, network, and paid API usage, overbroad invocation increases the chance of unnecessary data access, command execution, or credit consumption.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest presents the skill as using pre-analyzed ZooData review insights, but the fallback explicitly fetches live raw Amazon reviews and has the model analyze them. This changes the data provenance and privacy/compliance posture, and may expose users to undisclosed collection and processing of raw third-party content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation says the skill should only report what the API returns, yet the fallback requires the model to generate its own tags and semantic clusters. That can cause fabricated or non-reproducible outputs to be presented with the same authority as API-derived data, undermining integrity and potentially misleading downstream decisions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/reference.md (reported line 25)May include surrounding context.
md
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/zoodata.py (reported line 50)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/zoodata.py (reported line 87)May include surrounding context.
python
# ─── Configuration ─────────────────────────────────────────────────────────── DEFAULT_BASE_URL = "https://api.zoodata.ai/openapi/v2" API_BASE_PATH = "/openapi/v2" KEYWORD_DATE_RANGE_MAX_DAYS = 93 KEYWORD_TIMELINE_MAX_DAYS = 61

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/zoodata.py (reported line 258)May include surrounding context.
python
print(" export ZOODATA_API_KEY='hms_live_yourkey'", file=sys.stderr) print("", file=sys.stderr) print(" Method 2: User-home config (persistent, shared across all skills)", file=sys.stderr) print(" mkdir -p ~/.zoodata && chmod 700 ~/.zoodata", file=sys.stderr) print(' (umask 077; echo \'{"api_key":"hms_live_yourkey"}\' > ~/.zoodata/config.json)', file=sys.stderr) print(" # keep the file private (0600) — it holds a bearer credential", file=sys.stderr) print("", file=sys.stderr)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/zoodata.py (reported line 258)May include surrounding context.
python
print(" export ZOODATA_API_KEY='hms_live_yourkey'", file=sys.stderr) print("", file=sys.stderr) print(" Method 2: User-home config (persistent, shared across all skills)", file=sys.stderr) print(" mkdir -p ~/.zoodata && chmod 700 ~/.zoodata", file=sys.stderr) print(' (umask 077; echo \'{"api_key":"hms_live_yourkey"}\' > ~/.zoodata/config.json)', file=sys.stderr) print(" # keep the file private (0600) — it holds a bearer credential", file=sys.stderr) print("", file=sys.stderr)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code embeds a natural-language instruction requiring that output 'must be in English' and to translate non-English text before extraction. That is a locale/language policy constraint applied unconditionally, with no user choice or documented region-specific justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code exposes keyword SERP, traffic-term, and competitor keyword intelligence endpoints that are not justified by the stated review-intelligence purpose. In a skill marketed for consumer review insights, these capabilities materially expand data collection and competitive intelligence functionality, increasing the chance of misuse, over-collection, or bypass of product-level governance expectations.
Content: No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Confidence: 50% confidence
Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
Content: Scanner excerpt · scripts/zoodata.py (reported line 1234)May include surrounding context.
python
"priceMin", "priceMax", "ratingMin", "ratingMax", "bsrMin", "bsrMax", "salesGrowthRateMin", "salesGrowthRateMax", "sellerCountMin", "sellerCountMax", "variantCountMin", "variantCountMax"): val = getattr(args, attr.replace("Min", "_min").replace("Max", "_max") .replace("monthly", "monthly_").replace("review", "review_") .replace("sales", "sales_").replace("Growth", "_growth_") .replace("Rate", "rate_").replace("price", "price_")