Amazon Shopper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:04 AM UTC
• Version: 1.0.0

Overview

This Amazon automation skill can access login credentials and complete purchases or returns before the user reviews the final action.

Review this skill carefully before installing. Use it only if you are comfortable with an agent controlling an authenticated Amazon session, and modify the workflow to require manual login plus explicit approval before every purchase or return submission.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:13

Finding

Unconstrained Retrieval of Amazon Credentials from a Password Manager

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13
Vulnerability Type: Excessive credential access
Risk Level: High

Vulnerable Code Snippet:

markdown

- Logged into Amazon — if logged out, retrieve password from your password manager

Technical Analysis

The skill explicitly instructs the agent to retrieve an Amazon password from the user's password manager when the browser session is logged out. Direct access to stored credentials is not required to perform browser automation when authentication can instead be completed interactively by the user.

This instruction violates least-privilege principles by exposing a reusable authentication secret to the agent and its tool context. The skill does not constrain which password-manager entry may be accessed, prohibit copying the password into messages or logs, or define secure handling and disposal requirements. Although the reviewed file does not instruct credential exfiltration, granting this access increases the consequences of prompt manipulation, tool compromise, or an incorrect agent action.

Attack Path

1. The skill connects to Amazon and determines that the existing session is logged out.
2. Following the prerequisite instruction, the agent accesses the user's password manager.
3. The agent retrieves the Amazon password into its execution or tool context.
4. A malicious webpage, compromised tool, prompt-injection payload, or accidental logging behavior could cause the exposed credential to be copied, disclosed, or used outside the intended login operation.
5. An attacker obtaining the credential could authenticate to the Amazon account, subject to any additional MFA controls.

Impact Assessment

Exposure of the password could grant access to the user's Amazon account, including personal information, saved addresses, order history, return workflows, and purchasing capabilities associated with saved payment methods. The exact scope depen ...[truncated 191 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction permitting the agent to retrieve passwords from a password manager.
• Require the user to enter credentials and complete MFA directly in the browser.
• Explicitly prohibit the agent from reading, copying, storing, logging, or transmitting passwords, recovery codes, session tokens, and one-time codes.
• Pause the workflow when authentication is required and resume only after the user confirms that login is complete.
• Use a dedicated browser profile with the minimum necessary account access and protect its remote-debugging interface from untrusted local or network clients.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:58

Finding

Reorders Can Trigger Financial Transactions Without Final User Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:58-62 and SKILL.md:85-92
Vulnerability Type: Missing authorization before an irreversible purchase
Risk Level: High

Vulnerable Code Snippets:

markdown

### Reorders (items ordered before)
- Go directly to order history, search for item
- Click "Buy it again"
- Verify address and payment method
- **Place order without confirmation** — no screenshot needed

markdown

### Reorder flow
```bash
# From order history search results
agent-browser click @[buy-it-again-ref]
# Wait for checkout page
agent-browser snapshot
# Verify correct address and payment method are selected
agent-browser click @[place-order-ref]

text

### Technical Analysis

The reorder workflow explicitly bypasses user confirmation and directs the agent to activate the final “Place order” control. A previous purchase does not provide standing authorization for a new charge, particularly because price, seller, item variation, quantity, availability, shipping cost, delivery date, and user intent may have changed.

The workflow verifies only the address and payment method. It does not require validation of the final total, item identity, seller, variant, quantity, or delivery terms, and it establishes no spending limit. It also relies on dynamic browser element references, creating a risk that stale or incorrectly resolved references could select an unintended product or action.

### Attack Path

1. A user request is interpreted as a reorder.
2. The agent searches Amazon order history for the requested item.
3. An ambiguous search result, similar product, wrong variant, or manipulated page causes an incorrect “Buy it again” control to be selected.
4. The agent reaches checkout and checks only the selected address and payment method.
5. Under the explicit no-confirmation rule, the agent activates the final order button.
6. The Amazon account is charged and the p
...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval immediately before every purchase, including reorders.
• Present the exact product name, seller, variant, quantity, unit price, shipping cost, tax, final total, delivery estimate, shipping address, and payment-method description.
• Treat confirmation for one transaction as single-use authorization; do not infer authorization from order history.
• Add configurable per-order and cumulative spending limits.
• Re-read the checkout page immediately before submission rather than relying on stale element references.
• Stop and request clarification when search results are ambiguous, the price has changed, or the selected variant differs from the prior order.
• Report the order number and final charged amount after successful submission.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Return Workflow Submits Unverified Condition Declarations Without Pre-Submission Review

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-50
Vulnerability Type: Unsafe transaction defaults and missing user verification
Risk Level: Medium

Vulnerable Code Snippet:

markdown

### Default Answers (use unless user specifies otherwise)
- **Return reason:** "Changed Mind" → "My needs changed"
- **Packaging opened:** Yes
- **Item in original packaging:** Yes
- **Have you used the item:** Yes
- **Signs of use:** None
- **Battery leaks/overheating:** No
- **All accessories included:** Yes
- **Refund type:** Refund to original payment method (not replacement, not gift card)
- **Drop-off location:** Use `AMAZON_RETURN_DROPOFF` or Whole Foods

### Return Flow
1. Orders → Find item → "Return or replace items"
2. Select "Changed Mind" → "My needs changed" → Continue
3. Answer condition questions with defaults above
4. Continue past "Get Product Support" suggestions
5. Select "Refund to original payment method"
6. Select drop-off location
7. Confirm return
8. Done — QR code will be emailed

### Communication Style
- **Do NOT narrate each step** — just execute the whole return silently
- **Only message the user once it's confirmed** with a brief summary:

Technical Analysis

The skill provides fixed answers for factual product-condition questions and instructs the agent to use them unless the user proactively supplies alternatives. Assertions such as whether the item was used, whether accessories are present, whether signs of use exist, and whether a battery leaked cannot safely be inferred from a general default.

The return is confirmed before the user receives a summary. This prevents the user from reviewing the selected item, reason, condition declarations, refund amount and method, drop-off location, and deadline before the workflow creates the return. Incorrect declarations may affect eligibility, refund processing, merchant-policy compliance, or handling requirements ...[truncated 1153 chars]

Remediation

View remediation

Remediation Suggestions

• Ask the user to provide factual answers for every condition-dependent return question; do not infer physical item condition.
• Require a final confirmation before submission that includes the item and order, return reason, condition answers, refund amount and method, drop-off location, and return deadline.
• Treat hazardous-condition questions, including battery leakage or overheating, as mandatory user-verified fields.
• Stop and request clarification when item condition, included accessories, or packaging status is unknown.
• Allow defaults only for nonfactual preferences, clearly label them as proposed selections, and obtain approval before applying them.
• Provide the return confirmation, QR-code delivery method, and any cancellation or correction options after submission.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly authorizes placing reorder purchases without user confirmation, which is a direct financial action. Because reorders can still involve wrong quantities, changed prices, outdated addresses, or unintended products, skipping approval creates a clear risk of unauthorized purchases and monetary loss.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill provides preset answers for return-condition questions such as packaging, usage, and item condition, instructing the agent to use them unless the user specifies otherwise. These defaults can easily misstate the true condition of the item and may facilitate deceptive refund claims, which is especially risky in a commerce/returns workflow where representations affect eligibility and merchant decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to execute a return silently and only notify the user after confirmation, even though submitting a return is an externally meaningful, potentially irreversible account action. In the context of Amazon returns, this removes a critical consent checkpoint and can cause unintended refunds, account changes, or policy issues before the user has a chance to review details.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

This is a true instance of autonomous decision-making for a sensitive transaction: the agent is told to place an order 'without confirmation.' In a purchasing skill, autonomous completion of a checkout flow is especially dangerous because it converts browsing automation into unapproved spending with real-world consequences.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- Go directly to order history, search for item
- Click "Buy it again"
- Verify address and payment method
- **Place order without confirmation** — no screenshot needed

### New Items (never ordered before)
- Search or navigate to product

Static analysis

No suspicious patterns detected.