Amazon Voc 1.0.9

• Outcome: Review
• Latest audit: Jul 26, 2026 · 9:06 AM UTC
• Version: 1.0.0

Overview

The skill matches its Amazon review-analysis purpose, but an unvalidated API-server override could send an ARI key and review-analysis data to the wrong server if the environment is tampered with.

Review before installing. Use it only in a trusted shell or agent environment, leave ARI_BASE_URL and ARI_WEB_URL unset unless you intentionally point them at a trusted ARI development server, and revoke the ARI key if you suspect those variables were set unexpectedly. Expect the skill to store an ARI key locally and to spend ARI credits only after explicit confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            raw = resp.read().decode("utf-8")
            out = json.loads(raw) if raw else {"success": True, "data": None}

• Confidence: 96% confidence
• Finding: with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        req = urllib.request.Request(
            url, data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            content_type = resp.headers.get("Content-Type", "")
            if "text/event-stream" not in content_type:

• Confidence: 97% confidence
• Finding: with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(base_url() + path, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            note_release(resp.headers)
            out = json.loads(resp.read().decode("utf-8"))
            if isinstance(out, dict):

• Confidence: 95% confidence
• Finding: with urllib.request.urlopen(req, timeout=timeout) as resp:

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.