Security audit

Amazon Review Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Amazon review-monitoring purpose, but its script can be steered to make arbitrary HTTPS requests and lacks basic limits on scraping volume.

Review this skill before installing or running it. Use only trusted ASIN and marketplace values, keep page counts low, and be aware it scrapes live Amazon pages and saves review data locally. The publisher should add marketplace allowlisting, ASIN validation, page and response-size limits, redirect validation, and clearer disclosure around scraping and report storage.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:16
Finding: User-Controlled Marketplace Enables Arbitrary HTTPS Requests
Content: View full analysis
2 else "com" pages = int(sys.argv[3]) if len(sys.argv) > 3 else 3 result = monitor_asin(asin, marketplace, pages) ``` ### Technical Analysis The user-controlled `marketplace` argument is interpolated directly into the URL authority without validation: ```python f"https://www.amazon.{marketplace}/..." ``` URL authorities can contain user-information followed by an `@` delimiter. For example, a marketplace argument such as: ```text com@attacker.example ``` produces: ```text https://www.amazon.com@attacker.example/product-reviews/... ``` Under standard URL parsing rules, `www.amazon.com` is interpreted as user-information and `attacker.example` becomes the effective destination hostname. `urllib.request.urlopen()` therefore connects to the attacker-selected host rather than Amazon. The request is restricted to HTTPS by the fixed scheme, and TLS certificate validation limits which destinations can successfully respond. However, this does not prevent connections to attacker-controlled HTTPS servers or other r ...[truncated 1786 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/monitor.py:142
Finding: Unbounded Page Count and Response Reads Permit Resource Exhaustion
Content: View full analysis
2 else "com" pages = int(sys.argv[3]) if len(sys.argv) > 3 else 3 result = monitor_asin(asin, marketplace, pages) ``` ### Technical Analysis Two missing resource limits can be combined: 1. `pages` can be any integer accepted by Python, so a caller can request an extremely large number of sequential HTTP requests. 2. `resp.read()` has no size argument and consequently attempts to read the entire response body into memory. The 15-second timeout does not provide an adequate resource boundary. It applies per network operation rather than imposing a maximum total run time, request count, downloaded-byte budget, or response size. Each parsed review is also retained in `all_reviews` and subsequently serialized to a JSON report. A sufficiently large workload can therefore consume: - Network bandwidth. - Process memory. - CPU time during regular-expression parsing and sentiment analysis. - Disk space when the accumulated report is written. - Remote service request capacity. The arbitrary-host ...[truncated 1949 chars]
Remediation: View remediation
3 else 3 except ValueError: raise SystemExit("pages must be an integer") if not 1 <= pages <= MAX_PAGES: raise SystemExit(f"pages must be between 1 and {MAX_PAGES}") ``` 2. Limit each response body: ```python MAX_RESPONSE_BYTES = 2 * 1024 * 1024 with urllib.request.urlopen(req, timeout=15) as resp: data = resp.read(MAX_RESPONSE_BYTES + 1) if len(data) > MAX_RESPONSE_BYTES: raise ValueError("Response exceeds maximum permitted size") return data.decode("utf-8", errors="ignore") ``` 3. Inspect and validate `Content-Length` when present, while retaining the enforced streaming/read limit because that header may be absent or dishonest. 4. Establish total execution limits in addition to the per-request timeout: - Maximum request count. - Maximum cumulative downloaded bytes. - Maximum elapsed run time. - Maximum number of retained reviews. 5. Avoid retaining unnecessary data. Process pages incrementally and store only fields required for the report. 6. Apply a maximum report size or maximum review count before JSON serialization. 7. Handle resource-limit violations explicitly, stop further requests, and return a clear error instead of continuing with a partial uncontrolled workload. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly states it scrapes Amazon reviews from a live marketplace source, but it does not warn users about the operational and compliance risks of live scraping, such as violating site terms, triggering rate limits, or collecting changing third-party content. This omission can mislead users into running the tool without understanding that it interacts with an external service in a way that may carry legal, reliability, or account/IP blocking consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code persists fetched review content and analysis results to a local file under the reports directory, which is a file-write operation covered by the warning requirement for code files. Although the script prints the saved path afterward, there is no prior disclosure, confirmation, or explanatory comment/docstring near the write operation that the tool will store review text locally.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.