Amazon Sp Api

• Outcome: Pass
• Latest audit: Jun 19, 2026 at 8:46 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed Amazon Seller Central API helper that uses expected credentials and Amazon network calls for its stated purpose.

Install only if you intend to let an agent read Amazon Seller Central business data using your SP-API credentials. Use least-privilege IAM/SP-API permissions, keep secrets in your environment or secret manager rather than chat, and choose explicit report output paths when saving files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requires powerful capabilities—environment access for credentials, network access to Amazon endpoints, and file write for report output—but does not declare any permissions. Even though these capabilities are expected for an SP-API wrapper, the missing declaration weakens user visibility and policy enforcement, and could allow secret-bearing operations or file writes to occur without explicit approval boundaries.

VirusTotal

64/64 vendors flagged this skill as clean.