Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Amazon product-search integration, but users should understand it relies on a live logged-in browser session and an unpinned external MCP package.
Install this only if you are comfortable using Gecho Bridge, the Gecho Chrome extension, and a logged-in Amazon browser session for product research. Prefer pinning or reviewing the Gecho Bridge MCP package before use instead of blindly relying on @latest, and choose a save directory deliberately if storing raw results.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Join the [WeCom group](https://github.com/gecho-ai/gecho-bridge/blob/main/qywx.jpg) or use the [1:1 support QR code](https://github.com/gecho-ai/gecho-bridge/blob/main/wx.jpg).
## Output guidelines
For success:
- Say the tool completed.
The skill instructs users to install and run an MCP server via npx ...@latest, which pulls and executes the newest published package version without pinning or integrity control. If the upstream package is compromised or a malicious release is published, users could execute attacker-controlled code locally during setup.
The activation rule says to use this skill when the user asks to "collect structured results, save data, or research this platform," which is broader than a concrete trigger phrase list. Although nearby context is Amazon-focused, this wording does not clearly distinguish when this skill should activate versus other ecommerce or data-collection skills.
No suspicious patterns detected.