ClawHub
Back to skill

Security audit

Amazon Ads CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent Amazon Ads reporting helper, but it tells users to globally install an unpinned third-party CLI that will handle advertising credentials and business data.

Review before installing. Prefer a pinned, verified, isolated installation of the CLI, avoid global installs where possible, use least-privileged Amazon Ads credentials, store tokens with restrictive permissions, and treat profiles, campaign data, reports, and report URLs as sensitive business information.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:27
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-31
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: High

Vulnerable Code

markdown
If the CLI is not installed, install it:

```bash
npm install -g amazon-ads-open-cli
text

### Technical Analysis

The Skill instructs users or agents to install `amazon-ads-open-cli` globally from npm without specifying a reviewed version, validating an integrity hash, verifying publisher provenance, or reviewing the installed implementation.

Package installation can execute npm lifecycle scripts and place an executable in the user's global command path. Because no version is pinned, the effective code can change after this Skill has been reviewed. A compromised package release, maintainer account, or registry resolution could therefore introduce arbitrary code into the installation process.

This risk is especially significant because the installed CLI is subsequently expected to access an Amazon Ads OAuth access token, client ID, profile ID, advertising account data, and asynchronously generated reports. The project does not include the CLI implementation, so its credential handling, network destinations, and runtime behavior cannot be verified within the audited artifact.

### Attack Path

1. An attacker compromises the npm package, its maintainer account, or the package publication process.
2. The attacker publishes a malicious version under the same package name.
3. A user or agent follows the Skill instruction and runs `npm install -g amazon-ads-open-cli`.
4. npm resolves the unpinned package to the malicious release.
5. Malicious package code or lifecycle scripts execute with the privileges of the user performing the installation.
6. The globally installed executable can later access Amazon Ads credentials supplied through environment variables or `~/.config/amazon-ads-open-cli/credentials.json`.
7. The malic
...[truncated 1171 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a specific reviewed version instead of resolving the latest release:
    bash
    npm install -g amazon-ads-open-cli@<reviewed-version>
  2. Document the expected npm registry, package publisher, repository, and reviewed release checksum.
  3. Verify package integrity and provenance before installation, including npm provenance attestations where available.
  4. Prefer a project-local or isolated installation over a global installation to reduce command-path and system-wide exposure.
  5. Use a lockfile or another reproducible dependency mechanism where practical.
  6. Disable npm lifecycle scripts during installation when the reviewed package does not require them, and explicitly document any scripts that are necessary.
  7. Audit or vendor the executable implementation before allowing it to access Amazon Ads credentials.
  8. Run the CLI with a dedicated, least-privileged operating-system identity and an Amazon OAuth token restricted to the minimum required scopes.
  9. Store the credential file with restrictive filesystem permissions and avoid exposing tokens in command-line arguments, logs, or command output.
  10. Provide an approved installation artifact or verified release digest so the installed implementation cannot silently change after Skill review.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
## Authentication

The CLI requires an Amazon OAuth2 **access token** and **client ID** from a Login with Amazon app. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command) -- reads the specified JSON file
2. Auto-detected file: `~/.config/amazon-ads-open-cli/credentials.json`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
## Authentication

The CLI requires an Amazon OAuth2 **access token** and **client ID** from a Login with Amazon app. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command) -- reads the specified JSON file
2. Auto-detected file: `~/.config/amazon-ads-open-cli/credentials.json`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 476)May include surrounding context.

md
## Authentication

The CLI requires an Amazon OAuth2 **access token** and **client ID** from a Login with Amazon app. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command) -- reads the specified JSON file
2. Auto-detected file: `~/.config/amazon-ads-open-cli/credentials.json`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
The CLI requires an Amazon OAuth2 **access token** and **client ID** from a Login with Amazon app. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command) -- reads the specified JSON file
2. Auto-detected file: `~/.config/amazon-ads-open-cli/credentials.json`
3. Environment variables: `AMAZON_ADS_ACCESS_TOKEN` + `AMAZON_ADS_CLIENT_ID`

Note: when a credentials file is found (either via `--credentials` or at the default path), its `profile_id` can be overridden by the `AMAZON_ADS_PROFILE_ID` environment variable if the file does not contain one. If the credentials file is not found or does not contain valid `access_token` + `client_id`, the CLI falls through to environment variables.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md
The CLI requires an Amazon OAuth2 **access token** and **client ID** from a Login with Amazon app. Credentials are resolved in this order:

1. `--credentials <path>` flag (per-command) -- reads the specified JSON file
2. Auto-detected file: `~/.config/amazon-ads-open-cli/credentials.json`
3. Environment variables: `AMAZON_ADS_ACCESS_TOKEN` + `AMAZON_ADS_CLIENT_ID`

Note: when a credentials file is found (either via `--credentials` or at the default path), its `profile_id` can be overridden by the `AMAZON_ADS_PROFILE_ID` environment variable if the file does not contain one. If the credentials file is not found or does not contain valid `access_token` + `client_id`, the CLI falls through to environment variables.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims the CLI is read-only, but the description also says it can 'manage audiences', which implies state-changing operations. This mismatch can mislead operators into granting trust or running commands under the assumption that no account data or configuration will be modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation encourages retrieving ad account data and async report download URLs without warning that outputs may contain sensitive business information such as spend, campaign structure, audiences, and shareable report links. In an agent setting, users may paste or expose this data into broader contexts, increasing the chance of inadvertent data disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
68% confidence
Finding

The skill recommends creating a persistent credentials file under ~/.config, which can cause long-lived session material to remain on disk beyond the immediate task. In shared or multi-tenant environments, persistent local secrets increase the risk of later unauthorized reuse if file permissions, host isolation, or cleanup are weak.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

md
## Error handling

- **"No credentials found"** -- ask the user to set `AMAZON_ADS_ACCESS_TOKEN` + `AMAZON_ADS_CLIENT_ID` env vars, or create `~/.config/amazon-ads-open-cli/credentials.json`
- **"Profile ID required"** -- the command needs `AMAZON_ADS_PROFILE_ID`. Run `profiles` first to discover available profile IDs
- **HTTP 401** -- access token is expired or invalid; ask the user to refresh their OAuth token
- **HTTP 403** -- the profile may not have access to the requested resource, or the API scope is insufficient

Static analysis

No suspicious patterns detected.