Competitor Monitor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:51 AM UTC
• Version: 1.0.0

Overview

This Amazon competitor-monitoring skill is purpose-aligned, but it should go to Review because its executable code imports an unaudited dependency from outside the package and does not clearly disclose external API data handling.

Review before installing. Use this only in an environment where the external data-layer dependency is trusted, packaged or pinned, and not loaded from a shared writable path. Expect competitor targets such as brands and ASINs to be sent to external commerce-data providers, and only use data you are authorized to analyze.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/competitor_monitor.py:17

Finding

Unsafe Python Module Resolution Enables Local Dependency Hijacking

Content

View full analysis

Vulnerability Details

File Location: scripts/competitor_monitor.py, lines 17–18
Vulnerability Type: Local module search-path hijacking
Risk Level: High

python

sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', '..', 'scripts')))
from unified_data_layer_v2 import AmazonDataLayerV2

Technical Analysis

The script computes an external scripts directory three levels above its own directory and inserts that location at index 0 of sys.path. In the audited environment, the resulting path is /tmp/scripts. This gives modules in that directory precedence during Python import resolution.

The subsequent import of unified_data_layer_v2 executes the selected module's top-level code immediately. Because unified_data_layer_v2.py is not included in the audited project, neither its integrity nor its behavior can be verified from the supplied artifact. If an attacker can create or replace that module in the external directory, the legitimate-looking import will execute attacker-controlled Python code.

This is classified as tool hijacking because the code permits an external implementation to replace the expected data-layer tool. It also creates a dependency trust-boundary weakness, but T07: Tool Hijacking and Spoofing is the best matching primary classification.

Attack Path

1. An attacker obtains write access to /tmp/scripts, or otherwise controls the directory calculated by the relative path expression.
2. The attacker creates or replaces /tmp/scripts/unified_data_layer_v2.py.
3. The malicious module defines an apparently valid AmazonDataLayerV2 class while placing arbitrary operations in its top-level code or constructor.
4. A user or Agent launches scripts/competitor_monitor.py.
5. The script inserts /tmp/scripts at the beginning of sys.path.
6. Python resolves unified_data_layer_v2 from the attacker-controlled location and executes its top-level code.
7. The script instantiate ...[truncated 906 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the runtime modification of sys.path.
2. Package unified_data_layer_v2 inside a defined Python package and use an explicit package-relative import, for example:

python

from .unified_data_layer_v2 import AmazonDataLayerV2

3. If the data layer must remain a separately installed dependency:
   • Publish or retrieve it only from an authenticated, trusted package repository.
   • Pin an exact version.
   • Verify package hashes during installation.
   • Install it into an isolated virtual environment.
   • Do not resolve it from shared or temporary directories.
4. If an external path is unavoidable, resolve and validate its canonical path before use, require restrictive ownership and permissions, and reject directories writable by untrusted users.
5. Add a startup integrity check that confirms the imported module's resolved __file__ is within an approved package directory.
6. Include the dependency or a locked dependency manifest in the audited artifact so its implementation can be reviewed together with the Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The visible user-facing description and headings are presented in Chinese, which can constitute a language-policy issue if the skill forces a specific language without user opt-in. There is no indication that the user can choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains the title, class/docstring, and user-input examples entirely in Chinese, indicating the skill is designed around a fixed language experience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file documents dependencies on a unified data layer, an MCP client, and SellerSprite API access, which implies external data retrieval and transmission. The skill description does not include any user-facing notice about external API usage or handling of submitted competitor/ASIN monitoring targets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.