Security audit

Amazon评论深度分析

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate Amazon review-analysis purpose, but it can expose API keys and review data to arbitrary LLM endpoints and auto-opens generated HTML built from untrusted content.

Install only if you are comfortable sending review data and an LLM API key to the configured provider. Use only trusted HTTPS API endpoints, avoid custom or misspelled API bases, prefer throwaway/provider-specific keys, and treat generated reports as untrusted HTML until escaping and report-opening behavior are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ai_tagging.py:168
Finding: Arbitrary LLM endpoint receives the API credential and review content
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_report.py:129
Finding: Unescaped remote and AI-generated data allows stored script injection in automatically opened reports
Content: View full analysis
Amazon评论深度分析报告 - {product_info['title'][:50]} ``` ```python

{product_info.get('title', 'Unknown Product')}

ASIN: {product_info.get('asin', 'N/A')}

价格: {product_info.get('price', 'N/A')}

在Amazon查看产品 →

``` Review and AI-generated fields are also inserted without escaping: ```python html += f"""

评分: {'⭐' * review.get('rating', 0)}

标题: {review.get('title', '')}

内容: {review.get('body', '')[:200]}...

AI摘要: {tags.get('summary', '')}

痛点: {', '.join(tags.get('pain_points', [])) if tags.get('pain_points') else '无'}

卖点: {', '.join(tags.get('selling_points', [])) if tags.get('selling_points') else '无'}

""" ``` Chart labels are serialized inside an executable script element: ```python labels: """ + json.dumps([p[0] for p i ...[truncated 2589 chars]
Remediation: View remediation
` element or a separately generated JSON file. 4. When placing JSON in HTML, escape at least `<`, `>`, `&`, U+2028, and U+2029 so `` cannot terminate the containing element. 5. Use a templating engine with automatic context-aware escaping instead of constructing the report through f-string concatenation. 6. Add a restrictive Content Security Policy. Prefer locally bundled scripts and disallow inline scripts and event handlers. 7. Remove inline handlers such as `onerror` so the policy can prohibit inline JavaScript. 8. Stop automatically opening reports containing remote content, or require explicit user confirmation after generation. 9. Add regression tests containing payloads in every remote and AI-controlled field, including element-closing strings, quote-breaking attribute payloads, and `` sequences. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/generate_report.py:135
Finding: Generated reports execute third-party CDN JavaScript without integrity verification
Content: View full analysis
``` ### Technical Analysis Every generated report loads and executes Chart.js from a third-party CDN. The package version is pinned, which reduces accidental version drift, but the script does not include a Subresource Integrity hash. Consequently, the browser trusts whatever JavaScript is returned for that URL at report-opening time. This creates a supply-chain dependency on the CDN, its DNS and TLS infrastructure, and the hosted artifact. If any of these are compromised or the artifact is replaced, the effective code executed by an already-generated report can change without any modification to the audited Skill. The remote dependency also means that opening a report contacts a third party, potentially exposing network metadata even when the report itself was generated locally. ### Attack Path 1. An attacker compromises the CDN delivery path, hosted package artifact, or associated infrastructure. 2. The attacker causes the pinned Chart.js URL to return modified JavaScript. 3. A user opens a generated report while connected to the network. 4. The browser downloads and executes the modified script because no integrity hash is present. 5. The malicious script accesses report DOM content, modifies results, or transmits displayed data to an attacker-controlled service. ### Impact Assessment Successful exploitation permits JavaScript execution within the generated report. The attacker can read and alter the report DOM, exfiltrate displayed product and review analysis data, and perform browser-originated network requests. The issue does not independently grant native operating-system privileges. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (44)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A second behavior-mismatch finding indicates promised capabilities such as AI tagging, report generation, provider compatibility, and market selection may not actually exist or may behave differently than described. Security-relevant mismatches undermine user trust and can conceal unsafe data handling, silent failures, or unexpected outputs.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: A second behavior-mismatch finding indicates promised capabilities such as AI tagging, report generation, provider compatibility, and market selection may not actually exist or may behave differently than described. Security-relevant mismatches undermine user trust and can conceal unsafe data handling, silent failures, or unexpected outputs.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill allows dynamic external model/provider selection via API base and model parameters. This increases risk because users or downstream tooling can redirect sensitive prompts, review data, and API keys to unintended or malicious providers if there is no endpoint validation.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
OpenAI

text
--api-key sk-xxx --api-base https://api.openai.com/v1 --model gpt-4o-mini

DeepSeek（国内推荐）

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Provider configurability is useful, but it expands the attack surface by enabling data export to whatever endpoint the operator specifies. In a skill that handles external content and generates reports, that flexibility should be treated as a security control point, not just a feature.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
DeepSeek（国内推荐）

text
--api-key sk-xxx --api-base https://api.deepseek.com/v1 --model deepseek-chat

其他兼容API：只需修改 --api-base 和 --model

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/ai_tagging.py (reported line 165)May include surrounding context.
python
请直接输出JSON：""" return prompt def _call_llm_api(prompt: str, api_key: str, api_base: str, model: str, debug: bool) -> str:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The primary skill description is written in Chinese and the document does not indicate that other languages are supported or that the user may choose their preferred language. This can violate a language/locale policy when a skill implicitly requires a specific language without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README instructs users to provide LLM and RapidAPI keys and describes sending Amazon reviews to external APIs, but it does not clearly warn that review text and product-related data will be transmitted to third-party services for processing. This creates an informed-consent and data-governance risk: users may unknowingly send potentially sensitive content, violating internal policy, privacy expectations, or contractual restrictions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no explicit tool restrictions even though its documented behavior includes network access and writing HTML/CSV files. Without a least-privilege scope, an agent may grant broader-than-necessary capabilities, increasing the blast radius if the skill is modified, compromised, or triggered unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is written only in Chinese, and the document consistently presents the skill in Chinese without offering a language choice. This can constitute a language/locale policy issue when no opt-in or region-specific justification is provided.
Content: No source excerpt is available for this finding.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 70% confidence
Finding: Shadow Command Trigger: 'review analyzer' conflicts with built-in command 'review'
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger "产品洞察" is generic and could match many ordinary requests about product insights, not just Amazon review analysis. The manifest does not provide exclusion conditions or tighter scope to indicate when this skill should or should not activate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The trigger "review analyzer" is a broad English phrase that can apply to many contexts beyond Amazon reviews. Without narrowing context, it risks unintended activation from everyday analysis requests involving reviews in general.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill processes review text and product data via external providers, but the documentation does not clearly warn users that this content will be transmitted to third-party APIs. This creates a consent and data-handling risk, especially when reviews may contain personal information or when users assume processing is local.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The skill is configured to send data to an external API endpoint (DeepSeek). External transmission is expected for this use case, but it remains security-relevant because review content, prompts, and possibly metadata leave the local environment and may be retained or logged by the provider.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
python ~/.workbuddy/skills/amazon-review-analyzer/scripts/analyze.py
--asin B08N5WRWNW
--api-key YOUR_DEEPSEEK_KEY
--api-base https://api.deepseek.com/v1
--model deepseek-chat

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The documented default API base points to OpenAI, meaning user-supplied content will be transmitted externally unless overridden. That is not inherently malicious, but it is a real data exposure surface that requires notice and consent.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
| `--market` | ❌ | US | 市场区域：US/UK/DE/JP/FR/CA/IT/ES | | `--max-reviews` | ❌ | 500 | 最大评论数量（建议500-1000） | | `--api-key` | ✅ | - | LLM API Key（OpenAI/DeepSeek/其他兼容API） | | `--api-base` | ❌ | https://api.openai.com/v1 | API Base URL | | `--model` | ❌ | gpt-4o-mini | 模型名称 | | `--output` | ❌ | ./review_analysis_{ASIN}.html | 输出报告路径 | | `--rapidapi-key` | ❌ | 内置免费Key | RapidAPI Key（可选，内置有免费额度） |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The example command shows review-analysis data being sent to OpenAI. Because the skill handles potentially sensitive commercial input and possibly personal review text, this is a genuine external data-transfer risk even though it is core to the feature.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
OpenAI

text
--api-key sk-xxx --api-base https://api.openai.com/v1 --model gpt-4o-mini

DeepSeek（国内推荐）

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The example command sends data to DeepSeek, creating the same third-party data transfer concerns as other provider examples. Different providers may also imply different jurisdictions and retention practices, increasing compliance and privacy considerations.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
DeepSeek（国内推荐）

text
--api-key sk-xxx --api-base https://api.deepseek.com/v1 --model deepseek-chat

其他兼容API：只需修改 --api-base 和 --model

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The example references an external endpoint 'api.openseek.com', which appears inconsistent with the other documented providers and may reflect a typo or undocumented third-party destination. Ambiguous or incorrect endpoints are dangerous because users may unknowingly send API keys and data to the wrong service.
Content: Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.
--market US
--max-reviews 500
--api-key sk-xxx
--api-base https://api.openseek.com/v1

text
**分析报告示例截图**（略）

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 81)May include surrounding context.
md
def tag_review_with_ai( review: Dict, api_key: str, api_base: str = "https://api.openai.com/v1", model: str = "gpt-4o-mini", debug: bool = False ) -> Dict:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ai_tagging.py (reported line 16)May include surrounding context.
python
def tag_review_with_ai( review: Dict, api_key: str, api_base: str = "https://api.openai.com/v1", model: str = "gpt-4o-mini", debug: bool = False ) -> Dict:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/ai_tagging.py (reported line 64)May include surrounding context.
python
def tag_review_with_ai( review: Dict, api_key: str, api_base: str = "https://api.openai.com/v1", model: str = "gpt-4o-mini", debug: bool = False ) -> Dict:

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-controlled review text is embedded directly into the LLM prompt with no delimiting, sanitization, or stronger instruction hierarchy, so a malicious review can inject instructions like 'ignore prior directions' or manipulate the model's JSON output. In this skill, that can corrupt tagging results, trigger downstream parsing failures, or produce misleading reports at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction '如果评论是英文，请翻译成中文后再分析' imposes a specific language behavior regardless of user preference. This is a natural-language locale policy issue because the skill does not provide a language/locale choice or justify the forced Chinese output as a documented region-specific constraint.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This request transmits prompt contents, which include review text, to an external service. In the context of a review-analysis skill this is expected functionality, but it is still a real data-exposure boundary that can leak personal or proprietary content if users are unaware or if the endpoint is misconfigured.
Content: Scanner excerpt · scripts/ai_tagging.py (reported line 194)May include surrounding context.
python
if debug: print(f" API URL: {url}") response = requests.post(url, headers=headers, json=data, timeout=30) if response.status_code == 200: result = response.json()

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

{product_info.get('title', 'Unknown Product')}

T08 · Insecure Dependencies

SkillSpector

Tp2

Tp4

Tp4

External Model or Provider Selection

External Model or Provider Selection

Direct Prompt Extraction

Natural-Language Policy Violations

Missing User Warnings

Undeclared Tool Scope

Natural-Language Policy Violations

Shadow Command Trigger

Vague Triggers

Vague Triggers

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Ssd 1

Natural-Language Policy Violations

External Transmission