Product Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.0.0

Overview

The skill’s Amazon product-research purpose is coherent, but it loads an unaudited external Python module before running, so it belongs in Review rather than automatic trust.

Install only if you trust the local unified_data_layer_v2 provider and the external scripts directory it is loaded from. Before use, package or pin that dependency inside a trusted environment, keep the external directory non-writable by untrusted users, and expect the skill to operate primarily in Chinese for Amazon product research.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/product_research.py:15

Finding

Unsafe External Module Import Through a Prependable Search Path

Content

View full analysis

Vulnerability Details

File Location: scripts/product_research.py, lines 15–16
Vulnerability Type: Python module search-path manipulation and untrusted dependency loading
Risk Level: Medium

Vulnerable Code:

python

sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), '..', '..', '..', 'scripts')))
from unified_data_layer_v2 import AmazonDataLayerV2

Technical Analysis

The script constructs a directory outside the audited Skill package, inserts it at index zero of sys.path, and imports unified_data_layer_v2 from that search path. Index zero has the highest import priority, so a file named unified_data_layer_v2.py in the computed external directory can override other legitimate copies of that module.

The dependency is not present in the audited project. Consequently, its provenance, integrity, permissions, and runtime behavior cannot be verified from this package. If the external directory is writable by an untrusted user, another package, or a compromised process, this pattern creates a Python module-preloading vulnerability. Top-level code in a malicious replacement module would execute immediately when the import occurs, before ProductResearch is used.

Attack Path

1. An attacker identifies the external scripts directory computed relative to scripts/product_research.py.
2. The attacker obtains write access to that directory through weak filesystem permissions, a compromised deployment process, or another vulnerable component.
3. The attacker creates or replaces unified_data_layer_v2.py with malicious Python code that also exposes an AmazonDataLayerV2 symbol.
4. A user or agent invokes product_research.py.
5. The script prepends the external directory to sys.path.
6. Python resolves unified_data_layer_v2 from the attacker-controlled location and executes its top-level code during import.
7. The malicious implementation can then continue operat ...[truncated 929 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the runtime sys.path.insert modification and import the dependency through a normal, explicitly managed package:

   python

   from unified_data_layer_v2 import AmazonDataLayerV2
   

2. Package the data-layer module as a trusted project dependency or install it in an isolated virtual environment using a lock file with exact versions and integrity hashes.

3. If it is an internal component, use an explicit package namespace and relative import from within the audited package rather than searching a shared external directory.

4. Ensure dependency directories are owned by a trusted administrative or deployment account and are not writable by the Skill process or unrelated users.

5. Validate dependency provenance during deployment using signed artifacts, checksums, or an approved internal package registry.

6. Run the Skill under a least-privileged account with restricted filesystem, credential, and network access to reduce the impact of a compromised import.

7. Add a deployment test that verifies the resolved module path, for example through module.__file__, and fails closed if it is outside the approved immutable installation directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill description, examples, and expected outputs are all in Chinese with no language-selection behavior, which can force interaction in one language regardless of user preference. While not directly enabling code execution or data exfiltration, this can degrade user understanding, obscure limitations or risk disclosures, and increase the chance of misuse in multilingual environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example trigger phrase "分析下这个市场" is very broad and lacks scope constraints, so the skill may activate on generic market-analysis requests outside its intended Amazon product-research domain. This can cause unintended invocation, response hijacking from more appropriate skills, or disclosure/use of connected commercial data sources in irrelevant contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code presents the skill name, purpose, and primary documentation entirely in Chinese, indicating a fixed language/locale experience. The file does not mention any user opt-in, fallback, or language selection mechanism, which can violate language-choice policy for general-purpose skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The keyword extraction logic only strips Chinese phrases like "我想做", "分析", and "看看", which bakes a specific language assumption into the skill behavior. There is no user opt-in, locale selection, or documentation justifying this restriction, so it constitutes a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The analyze() method documents and implements returning a full research report dict, with 'decision' itself set to the dict returned by _make_decision() at L85 and L92. However, the main test block prints result['decision'] directly as if it were a scalar decision label, which contradicts the actual return shape and intent of the method's documented output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.