ClawHub
Back to skill

Security audit

Amazon

Security checks for vulnerabilities and agentic risk

Overview

This Amazon shopping skill is transparent about automating purchases and returns, but it gives the agent too much authority over payments, returns, and credentials without enough user confirmation.

Install only if you are comfortable letting an agent operate inside an authenticated Amazon browser profile. Before use, require manual login, explicit approval before every order or return submission, and direct user-provided answers for product-condition questions. Do not let the agent read passwords from a password manager.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:59
Finding

Reorders Can Be Purchased Without Transaction-Specific User Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-63
Vulnerability Type: Missing authorization for a financial transaction
Risk Level: High

Vulnerable Code Snippet:

markdown
### Reorders (items ordered before)
- Go directly to order history, search for item
- Click "Buy it again"
- Verify address and payment method
- **Place order without confirmation** — no screenshot needed

Technical Analysis

The Skill explicitly instructs the agent to place reorders without obtaining transaction-specific confirmation. A previous purchase does not constitute authorization for a new charge. Material transaction attributes—including current price, quantity, seller, delivery date, shipping address, and payment method—may differ from the previous order.

This violates least-privilege and transaction-authorization principles by granting the agent standing authority to perform a consequential financial action. Verification performed solely by the agent is not an adequate substitute for informed user approval.

Attack Path

  1. The user, an ambiguous request, or attacker-controlled content prompts the agent to reorder a previously purchased item.
  2. The agent searches the authenticated Amazon order history.
  3. The agent selects the "Buy it again" action.
  4. The current transaction details may differ from those of the historical order.
  5. Following the Skill instructions, the agent submits the order without presenting the final details to the user.
  6. Amazon charges the selected payment method and schedules delivery without transaction-specific approval.

Impact Assessment

Exploitation can cause unauthorized financial charges and deliveries through the authenticated Amazon account. The scope includes any item available through the account's reorder history and any payment method or address selectable during checkout. The Skill does not grant operating-system privilege escalation, but it exer ...[truncated 93 chars]

Remediation
View remediation

Remediation Suggestions

  • Require explicit user confirmation immediately before submitting every order, including reorders.
  • Present the exact product, variation, quantity, seller, unit price, taxes, shipping fees, total charge, delivery estimate, shipping address, and payment method.
  • Treat any change to transaction details after confirmation as invalidating that confirmation.
  • Never interpret prior purchase history as standing authorization for future purchases.
  • Add a mandatory confirmation checkpoint before invoking the final "Place order" control.
  • Record only a non-sensitive confirmation result and avoid retaining payment details.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:25
Finding

Returns Are Confirmed Silently Using Unverified Product-Condition Statements

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-55
Vulnerability Type: Unauthorized account transaction and unverified factual declarations
Risk Level: High

Vulnerable Code Snippet:

markdown
### Default Answers (use unless user specifies otherwise)
- **Return reason:** "Changed Mind" → "My needs changed"
- **Packaging opened:** Yes
- **Item in original packaging:** Yes
- **Have you used the item:** Yes
- **Signs of use:** None
- **Battery leaks/overheating:** No
- **All accessories included:** Yes
- **Refund type:** Refund to original payment method (not replacement, not gift card)
- **Drop-off location:** Use `AMAZON_RETURN_DROPOFF` or Whole Foods

### Return Flow
1. Orders → Find item → "Return or replace items"
2. Select "Changed Mind" → "My needs changed" → Continue
3. Answer condition questions with defaults above
4. Continue past "Get Product Support" suggestions
5. Select "Refund to original payment method"
6. Select drop-off location
7. Confirm return
8. Done — QR code will be emailed

### Communication Style
- **Do NOT narrate each step** — just execute the whole return silently
- **Only message the user once it's confirmed** with a brief summary:
  - Item name
  - Refund amount
  - Drop-off location & deadline
- If something goes wrong or needs clarification, then ask

Technical Analysis

The Skill supplies default answers for factual questions about packaging, usage, accessories, damage, and battery condition. These facts cannot be reliably inferred by an agent from the Amazon account. Automatically submitting them may create inaccurate representations during the return process.

The workflow also directs the agent to confirm the return silently and communicate only afterward. This eliminates the final authorization checkpoint for the selected item, refund amount, refund destination, drop-off method, and deadline. A general request to inv ...[truncated 1212 chars]

Remediation
View remediation

Remediation Suggestions

  • Obtain product-condition facts directly from the user rather than applying defaults.
  • Distinguish optional preferences from factual declarations that the agent cannot verify.
  • Before submission, present the selected item, return reason, condition answers, refund amount, refund destination, drop-off method, location, and deadline.
  • Require explicit user confirmation immediately before the final return-submission action.
  • Ask for clarification whenever any factual answer or transaction term is unknown.
  • Permit silent automation only for reversible navigation steps, not for final account-changing actions.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:11
Finding

Password-Manager Credential Retrieval Is Requested Without Secret-Handling Safeguards

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-15
Vulnerability Type: Excessive access to sensitive credentials
Risk Level: High

Vulnerable Code Snippet:

markdown
## Prerequisites

- `agent-browser` CLI installed
- Chrome running with `--remote-debugging-port=9222` (see [Starting the browser](#starting-the-browser-if-not-running))
- Logged into Amazon — if logged out, retrieve password from your password manager
- If running headless (Linux/VNC), forward the VNC port to verify visually: `ssh -L 6080:localhost:6080 <host>` → http://localhost:6080/vnc.html

Technical Analysis

The instruction expands the agent's authority from controlling Amazon to retrieving secrets from a password manager. It does not require user-mediated authentication or a password-manager autofill mechanism that keeps the secret hidden from the agent. It also provides no explicit controls preventing passwords from being included in browser snapshots, model context, command arguments, logs, screenshots, temporary files, or messages.

A password manager is a high-value security boundary that can contain credentials unrelated to the requested shopping task. Direct secret retrieval exceeds the minimum access necessary when user login or opaque autofill can achieve the same result.

Attack Path

  1. The Amazon browser session is logged out or expires.
  2. Following the Skill instructions, the agent accesses the user's password manager.
  3. The agent retrieves the Amazon password as readable data rather than requesting user authentication or opaque autofill.
  4. The credential may enter observable model context, browser snapshots, logs, screenshots, shell history, or error output.
  5. Anyone with access to those artifacts could obtain the credential and authenticate to the Amazon account.
  6. If password-manager navigation is not strictly scoped, unrelated stored credentials may also become visible.

Impa

...[truncated 483 chars]

Remediation
View remediation

Remediation Suggestions

  • Require the user to perform login and multifactor authentication manually.
  • If automation is necessary, use password-manager autofill that never exposes the secret value to the agent.
  • Explicitly prohibit reading, copying, storing, logging, screenshotting, or transmitting passwords and authentication tokens.
  • Limit password-manager access to the exact Amazon credential and deny browsing of unrelated vault entries.
  • Pause execution when authentication is required and resume only after the user confirms successful login.
  • Use short-lived delegated credentials or platform-supported authentication mechanisms where available.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:77
Finding

Shared-Browser Isolation Requirement Is Contradicted by Unsafe Command Examples

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 77-86
Vulnerability Type: Unsafe shared-browser session handling
Risk Level: Medium

Vulnerable Code Snippet:

markdown
### Connect to browser
```bash
agent-browser connect 9222

Always open a new tab — other sessions share the same Chrome. Use --new-tab on every open command.

Search order history

bash
agent-browser open "https://www.amazon.com/gp/your-account/order-history"
agent-browser snapshot -i
# Find search box, fill with item name, click search
text

### Technical Analysis

The Skill recognizes that multiple sessions share the same Chrome instance and mandates use of `--new-tab`. However, the immediately following executable example omits that option. Agents commonly follow command examples directly, so the documented workflow can reuse or disrupt an existing tab despite the stated isolation requirement.

Opening and manipulating pages in a shared browser without a dedicated tab or session identifier can cause subsequent snapshots and element references to target another task's page. Browser state such as the active account, selected order, checkout state, and tab focus may therefore cross session boundaries.

### Attack Path

1. Two or more agent tasks share the Chrome instance connected through port 9222.
2. One task has an authenticated or transaction-sensitive page open.
3. The Amazon Skill executes the provided `agent-browser open` example without `--new-tab`.
4. The command reuses or changes shared browser state instead of creating an isolated tab.
5. Snapshots, searches, and clicks operate against stale or unintended state.
6. Account information may be exposed to the wrong task, or a purchase or return action may affect the wrong browser workflow.

### Impact Assessment

The issue can cause cross-session data exposure, disruption of another task, use of the wrong authenticated account, or uni
...[truncated 281 chars]
Remediation
View remediation

Remediation Suggestions

  • Update every agent-browser open example to include --new-tab.
  • Use a dedicated browser profile or isolated CDP browser context for each task instead of sharing a single Chrome profile.
  • Track and validate a task-specific tab identifier before every snapshot, click, or form submission.
  • Verify the active origin and authenticated Amazon account before any sensitive operation.
  • Discard stale element references after navigation or focus changes.
  • Abort if tab ownership, account identity, or browser context cannot be verified.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill directs the agent to place reorder purchases without user confirmation, which authorizes a financial transaction based only on inferred intent. In context, this is especially dangerous because reorders can still have real monetary, shipping, and account consequences even if the item was purchased before.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description is broad enough to trigger on common purchasing and returns tasks without clearly signaling the financial and account-impacting nature of the actions. Overbroad invocation increases the chance the skill is used in situations where explicit user intent, guardrails, or confirmation should have been required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the agent to retrieve the user's Amazon password from a password manager if the user is logged out. That expands the skill from browser automation into credential access, exposing highly sensitive secrets and creating a path for account compromise or misuse well beyond the stated shopping workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The return workflow tells the agent to complete returns silently and notify the user only after confirmation, removing the user's opportunity to review return reason, refund method, and drop-off details before submission. This can cause unwanted account actions, inaccurate return attestations, or loss of user control over a consequential transaction.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

This is a clear case of autonomous decision-making for a financially consequential action: the agent is instructed to complete checkout 'without confirmation.' In a purchasing skill, autonomous completion is more dangerous because mistakes directly create charges, shipments, and downstream return burdens.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
- Go directly to order history, search for item
- Click "Buy it again"
- Verify address and payment method
- **Place order without confirmation** — no screenshot needed

### New Items (never ordered before)
- Search or navigate to product

Static analysis

No suspicious patterns detected.