Security audit

亚马逊品牌口碑监控 · 评论舆情追踪

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed ARI CLI integration for Amazon review monitoring and adjacent seller workflows, with paid and mutating actions gated by user confirmation.

Install only if you trust ARI/funewa with your Amazon review workflow data and API key. Review costs before confirming any paid command, be aware that schedules/competitor tracking can cause future collection charges, and keep the saved API key out of shared machines or synced folders.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises and instructs use of shell execution, network access, environment-variable handling, and local file writes, yet no explicit permissions declaration is present. This creates a transparency and least-privilege problem: users and hosting systems cannot accurately assess or constrain what the skill may access, including local API key storage and outbound requests.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is narrow brand/review monitoring, but the skill also instructs broader account, billing, export, workflow execution, report retrieval, and watch-management actions. This mismatch can mislead users into authorizing a tool for seemingly limited analysis while it can perform account-affecting and potentially billable operations beyond the stated scope.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill advertises brand/reputation monitoring, but this section adds broader product-operations workflows that can run operational analyses outside that stated scope. Scope expansion is dangerous because an agent or user may invoke higher-risk capabilities than expected, leading to unauthorized actions, charges, or processing of data under a misleading trust model.

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The skill persists an API key to ~/.ari/config.json and also supports writing exported files locally, but those behaviors are not reflected in the monitoring-focused description. Undisclosed local persistence is risky because users and calling agents may assume the skill is read-only/network-only when it actually stores secrets and artifacts on disk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Generating per-review AI response advice goes beyond passive reputation monitoring into active operational/customer-response assistance. This broadens the skill's authority and may lead users or agents to take actions based on AI-generated communications that were never disclosed as part of the skill's purpose.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This code mutates review handling status through PUT requests, which is an active state-changing capability inconsistent with a monitoring-only skill description. Hidden mutation capabilities are dangerous because they can alter operational records and workflows under the guise of a read/monitor tool.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation guidance uses broad natural-language triggers such as reputation monitoring, alerts, tracking, and brand evaluation without clear exclusions. In context, those triggers can cause the agent to enter a skill that supports state-changing and billable commands, increasing the chance of accidental over-invocation or use in situations the user did not intend.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.