Amazon Voc 1.0.9

• Outcome: Review
• Latest audit: Jul 26, 2026 · 9:06 AM UTC
• Version: 1.0.0

Overview

The skill matches its Amazon review-analysis purpose, but an unvalidated API-server override could send an ARI key and review-analysis data to the wrong server if the environment is tampered with.

Review before installing. Use it only in a trusted shell or agent environment, leave ARI_BASE_URL and ARI_WEB_URL unset unless you intentionally point them at a trusted ARI development server, and revoke the ARI key if you suspect those variables were set unexpectedly. Expect the skill to store an ARI key locally and to spend ARI credits only after explicit confirmation.

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(url, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            raw = resp.read().decode("utf-8")
            out = json.loads(raw) if raw else {"success": True, "data": None}

• Confidence: 96% confidence
• Finding: The request destination is derived from base_url(), which accepts ARI_BASE_URL from the environment, and the same request includes the Bearer API key in the Authorization header. If an attacker can influence environment variables or invocation context, they can redirect authenticated requests to an attacker-controlled host and exfiltrate the API key and request data.

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

try:
        req = urllib.request.Request(
            url, data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST")
        with urllib.request.urlopen(req, timeout=SSE_TIMEOUT_SEC) as resp:
            note_release(resp.headers)
            content_type = resp.headers.get("Content-Type", "")
            if "text/event-stream" not in content_type:

• Confidence: 97% confidence
• Finding: The SSE endpoint URL is also built from the environment-controlled base_url(), and the stream request sends the Authorization Bearer token plus analysis payload to that host. This makes credential exfiltration and sensitive data disclosure possible if ARI_BASE_URL is tampered with, and streaming does not reduce that risk.

Tainted flow: 'req' from os.environ.get (line 469, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
    try:
        req = urllib.request.Request(base_url() + path, data=data, headers=headers, method=method)
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            note_release(resp.headers)
            out = json.loads(resp.read().decode("utf-8"))
            if isinstance(out, dict):

• Confidence: 95% confidence
• Finding: Unauthenticated public requests in request_public() also honor ARI_BASE_URL from the environment. Although no bearer token is sent, this can redirect device authorization flows, allowing phishing or delivery of attacker-controlled verification URLs and poll responses that could mislead the user or capture authorization secrets.

Static analysis

No suspicious patterns detected.