Affiliatematic

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

The skill is coherent, but it asks site owners to embed an unpinned third-party script that can inspect page content and run on visitor pages without enough privacy or containment guidance.

Review carefully before installing. Use this only on public, non-sensitive pages unless you have verified Affiliatematic's data handling, retention, and compliance posture. Ask for version-pinned script URLs, SRI hashes, CSP guidance, or a sandboxed/self-hosted option before deploying broadly, because changes to the remote script would affect site visitors automatically.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:51

Finding

Mutable Third-Party JavaScript Executes in the Website Origin

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51 and 96
Vulnerability Type: Remote, unpinned executable JavaScript
Risk Level: High

Complete vulnerable code snippet (line 51):

html

<script src="https://affiliatematic.com/amazon-widget.iife.js" async></script>

Repeated integration example (line 96):

html

<script src="https://affiliatematic.com/amazon-widget.iife.js" async></script>

Technical Analysis

The Skill directs users to load executable JavaScript from a mutable external URL. The resource is not pinned to an immutable version and is not protected by a Subresource Integrity hash. The documentation also provides no audited self-hosting procedure, sandboxing boundary, or restrictive Content Security Policy guidance.

Consequently, the code that ultimately executes can change after the Skill has been audited. Because an ordinary script element executes in the embedding page's origin context, the downloaded code can interact with the page DOM, read browser-visible content available to scripts, alter links and displayed recommendations, initiate network requests, and access non-HttpOnly origin data where browser policy permits.

The async attribute only changes loading behavior; it does not isolate the script or reduce its privileges. This is classified as T03: Remote Payload Retrieval and Execution because the effective executable payload is retrieved from an external URL and can be replaced independently of the reviewed Skill.

Attack Path

1. A website owner follows the Skill and embeds the specified external script.
2. An attacker compromises the provider's server, deployment pipeline, DNS, account, or another mechanism controlling the script response. The same risk exists if the provider itself later serves unsafe code.
3. The attacker replaces amazon-widget.iife.js while retaining the documented URL.
4. Visitors load a participating website, and their ...[truncated 1134 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish immutable, versioned script URLs rather than a mutable filename, and require integrations to pin a reviewed version.
2. Publish a cryptographic Subresource Integrity hash and use it with an appropriate CORS configuration:

   html

   <script
     src="https://affiliatematic.com/amazon-widget-1.2.3.iife.js"
     integrity="sha384-REPLACE_WITH_VERIFIED_HASH"
     crossorigin="anonymous"
     async>
   </script>
   

3. Provide an audited self-hosting option so website owners can review, pin, and deploy the exact script artifact themselves.
4. Prefer rendering the third-party widget inside a separate-origin sandboxed iframe with only the minimum required sandbox capabilities.
5. Document all data read, processed, stored, and transmitted by the widget, including page title, metadata, text, visitor identifiers, and destination endpoints.
6. Recommend a restrictive Content Security Policy that limits script and network destinations to explicitly required origins.
7. Protect the provider's release pipeline with signed artifacts, multi-party release approval, MFA, access logging, dependency scanning, and rapid revocation procedures.
8. Maintain versioned hashes and a public security advisory process so integrators can validate updates before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest trigger list includes generic phrases such as "affiliate marketing" and "product recommendations," which are broad enough to overlap with ordinary user requests not specifically about this skill. The description does not provide narrowing conditions or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to embed a remotely hosted third-party script that analyzes page content, but it does not disclose what data is transmitted off-site, how content is processed, or any privacy/compliance considerations. On pages containing sensitive, internal, user-specific, or regulated content, this could result in unintended disclosure of page data to affiliatematic.com and creates a supply-chain trust dependency on an externally controlled script.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.