Security audit

Amazon评论深度分析

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it advertises, but it sends review data to external APIs and auto-opens an unescaped HTML report built from fetched review content, so users should review it before installing.

Install only if you are comfortable sending Amazon review text, product metadata, and your selected LLM API key to the configured external providers. Use a trusted api_base, avoid confidential business notes in prompts, consider mock/local modes for testing, and inspect generated reports carefully because fetched review text is inserted into an auto-opened HTML file without evident escaping.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill describes network access to RapidAPI/OpenAI-compatible endpoints and local file generation/opening, yet no explicit permissions are declared. This creates a transparency and consent gap: users and the host platform may not realize the skill can transmit product/review data externally and write HTML/CSV files locally.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: An overly broad trigger can cause the skill to activate for ordinary product-insight requests that users did not intend to route through this tool. Because this skill performs network calls and generates local files, accidental invocation increases the chance of unintended data transmission and side effects.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Another broad everyday-language trigger overlaps with generic analysis requests, making unintended activation plausible. In this skill, accidental activation matters because it may send user-supplied content to external LLM/API providers and create output files locally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The description emphasizes functionality but does not clearly warn that product/review data will be transmitted to third-party APIs and that an HTML report will be generated and opened locally. Missing disclosure undermines informed consent and can expose sensitive business research or user data to external processors unexpectedly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code transmits review text and associated metadata to a third-party LLM endpoint using requests.post, but this module contains no consent gate, disclosure, redaction, or data-minimization control. That creates a privacy and compliance risk because user-supplied content may include personal or sensitive information and can be sent to arbitrary api_base destinations.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: When real reviews are processed, the script sends their contents to a third-party LLM API without an explicit privacy notice or confirmation step. Even if reviews are public, the transmitted dataset may include usernames, dates, purchase indicators, or other metadata, creating an avoidable data-sharing and compliance risk for users who may not realize external processing occurs.

External Transmission

Medium

Category: Data Exfiltration
Content: python scripts/analyze.py \ --asin B08N5WRWNW \ --api-key YOUR_DEEPSEEK_KEY \ --api-base https://api.deepseek.com/v1 \ --model deepseek-chat ```
Confidence: 88% confidence
Finding: The skill explicitly sends review content and user-supplied API credentials to third-party LLM infrastructure (here DeepSeek-compatible endpoint). External transmission is expected for this tool's functionality, but it still creates a real data exposure surface because scraped reviews, prompts, and potentially product intelligence leave the local environment and are processed by an external provider.

External Transmission

Medium

Category: Data Exfiltration
Content: | `--market` | ❌ | US | 市场区域：US/UK/DE/JP/FR/CA/IT/ES | | `--max-reviews` | ❌ | 500 | 最大评论数量（建议 500-1000） | | `--api-key` | ✅ | - | LLM API Key（OpenAI/DeepSeek/其他兼容 API） | | `--api-base` | ❌ | https://api.openai.com/v1 | API Base URL | | `--model` | ❌ | gpt-4o-mini | 模型名称 | | `--output` | ❌ | ./review_analysis_{ASIN}.html | 输出报告路径 | | `--rapidapi-key` | ❌ | 内置免费 Key | RapidAPI Key（可选） |
Confidence: 90% confidence
Finding: The documented default API base points to OpenAI, meaning comment text and derived analysis will be transmitted to an external service during normal operation. In this skill context that behavior is intentional, but it remains security-relevant because product review corpora and any embedded sensitive text are exported off-platform.

External Transmission

Medium

Category: Data Exfiltration
Content: --market US \ --max-reviews 500 \ --api-key sk-xxx \ --api-base https://api.deepseek.com/v1 ``` ## 📊 输出报告内容
Confidence: 88% confidence
Finding: This example again instructs users to direct review-analysis data to the DeepSeek API, confirming routine external transmission. While aligned with the tool's purpose, repeated encouragement to use third-party endpoints increases the chance that users unknowingly send commercially sensitive review datasets to external processors.

External Transmission

Medium

Category: Data Exfiltration
Content: python ~/.workbuddy/skills/amazon-review-analyzer/scripts/analyze.py \ --asin B08N5WRWNW \ --api-key YOUR_DEEPSEEK_KEY \ --api-base https://api.deepseek.com/v1 \ --model deepseek-chat ```
Confidence: 90% confidence
Finding: The skill explicitly instructs users to send ASIN-linked review content to an external DeepSeek API endpoint. External transmission is expected for the feature, but it remains security-relevant because third-party processing can expose proprietary market research, customer text, and prompts if not clearly consented to and controlled.

External Transmission

Medium

Category: Data Exfiltration
Content: | `--market` | ❌ | US | 市场区域：US/UK/DE/JP/FR/CA/IT/ES | | `--max-reviews` | ❌ | 500 | 最大评论数量（建议500-1000） | | `--api-key` | ✅ | - | LLM API Key（OpenAI/DeepSeek/其他兼容API） | | `--api-base` | ❌ | https://api.openai.com/v1 | API Base URL | | `--model` | ❌ | gpt-4o-mini | 模型名称 | | `--output` | ❌ | ./review_analysis_{ASIN}.html | 输出报告路径 | | `--rapidapi-key` | ❌ | 内置免费Key | RapidAPI Key（可选，内置有免费额度） |
Confidence: 90% confidence
Finding: The default API base points to an external OpenAI endpoint, meaning user input and collected review data are transmitted off-platform. This is not inherently malicious, but it is a real data-exposure risk when combined with insufficient permission declaration and limited disclosure.

External Transmission

Medium

Category: Data Exfiltration
Content: **OpenAI** ``` --api-key sk-xxx --api-base https://api.openai.com/v1 --model gpt-4o-mini ``` **DeepSeek（国内推荐）**
Confidence: 90% confidence
Finding: The skill provides concrete usage that sends data to OpenAI's external API. Because the skill analyzes potentially large volumes of review text and may include user annotations or business context, this transmission can leak commercially sensitive information if users are not adequately warned.

External Transmission

Medium

Category: Data Exfiltration
Content: **DeepSeek（国内推荐）** ``` --api-key sk-xxx --api-base https://api.deepseek.com/v1 --model deepseek-chat ``` **其他兼容API**：只需修改 `--api-base` 和 `--model`
Confidence: 90% confidence
Finding: The DeepSeek example likewise routes data to an external provider, creating the same confidentiality and compliance concerns as other remote LLM endpoints. The danger is elevated slightly by the skill's framing as an easy turnkey workflow, which may cause users to overlook where data is going.

External Transmission

Medium

Category: Data Exfiltration
Content: --market US \ --max-reviews 500 \ --api-key sk-xxx \ --api-base https://api.openseek.com/v1 ``` **分析报告示例截图**（略）
Confidence: 93% confidence
Finding: This example uses a nonstandard external API base ('api.openseek.com'), which increases the risk of data being sent to an unintended, mistyped, or unvetted third party. When a skill encourages arbitrary compatible API bases without trust validation, users may expose large datasets and API keys to malicious or mistaken endpoints.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Amazon评论深度分析助手 - Python依赖 # LLM API调用 requests>=2.31.0 # HTML解析（如需爬取评论） beautifulsoup4>=4.12.0
Confidence: 88% confidence
Finding: Using requests>=2.31.0 leaves the dependency unpinned, so future installs may pull in different versions with incompatible behavior or newly introduced vulnerabilities. In a skill that performs network access to external APIs, dependency drift increases supply-chain and reliability risk because security posture can change without code changes.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.31.0 # HTML解析（如需爬取评论） beautifulsoup4>=4.12.0 lxml>=4.9.0 # 数据处理
Confidence: 86% confidence
Finding: beautifulsoup4>=4.12.0 is unpinned, which allows dependency drift and makes builds non-reproducible. Because this skill parses externally sourced Amazon review HTML or related content, parser-library changes can unexpectedly alter parsing behavior or introduce supply-chain exposure.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # HTML解析（如需爬取评论） beautifulsoup4>=4.12.0 lxml>=4.9.0 # 数据处理 pandas>=2.0.0 # 可选，用于数据导出
Confidence: 90% confidence
Finding: lxml>=4.9.0 is unpinned, so deployments may resolve to versions with different security properties or parser behavior. Since lxml processes untrusted remote content, version drift is more dangerous here than in a purely local tool because parser bugs can become reachable through attacker-controlled input.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The requirements file allows installation of requests versions associated with multiple published advisories, and the package is used for outbound network communication to APIs. In this skill context, issues such as credential leakage, redirect handling flaws, or TLS/session verification problems can expose API keys, session data, or fetched content integrity.

Known Vulnerable Dependency: lxml — 10 advisory(ies): CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +7 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The requirements file permits lxml versions with numerous known advisories, and lxml is commonly used to parse attacker-influenced HTML/XML content. In a review-scraping and HTML-reporting skill, parser and cleaner vulnerabilities can enable script-passing, XSS-like report contamination, or unsafe processing of crafted markup.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 84% confidence
Finding: The trigger 'review analyzer' can shadow or conflict with a built-in 'review' command, creating ambiguity about which handler executes. If this skill is selected unintentionally, it may perform network access and local file writes under circumstances where the user expected a benign built-in review action.

Static analysis

No suspicious patterns detected.