ClawHub
Back to skill

Security audit

Amazon Paapi

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to look up Amazon product data, but it asks users to expose sensitive Amazon credentials while the included client does not actually use them to authenticate requests.

Install only after reviewing the credential risk. Do not place Amazon access keys or secret keys in a shared ~/.env file; use a protected secret store or tightly permissioned dedicated config, and expect this client may not work as a real authenticated PA API client until signing is implemented.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:43
Finding

Long-lived Amazon credentials are stored in a plaintext home-directory file

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:43-47; duplicated in README.md:20-27
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable Code or Instructions

SKILL.md:43-47:

bash
### 3. Credentials speichern
```bash
echo 'AMAZON_ACCESS_KEY=AKIA...' >> ~/.env
echo 'AMAZON_SECRET_KEY=...' >> ~/.env
echo 'AMAZON_PARTNER_TAG=deinname-21' >> ~/.env
text

Equivalent instructions appear in `README.md:20-27`:

```markdown
## Setup
1. Bei https://affiliate-program.amazon.de/ anmelden
2. Zu "Produktwerbung-API" navigigieren
3. Credentials generieren
4. In `.env` speichern:

AMAZON_ACCESS_KEY=AKIA... AMAZON_SECRET_KEY=... AMAZON_PARTNER_TAG=jensbuermann-21

text

Technical Analysis

The installation instructions direct users to append long-lived Amazon access credentials to a plaintext file under the home directory. They do not require restrictive permissions, such as mode 0600, or recommend a protected operating-system credential store.

The use of repeated append operations also leaves previous or duplicate credentials in place. Rotation therefore may not reliably remove obsolete secrets. Additionally, the implementation does not load ~/.env itself, meaning the documented storage procedure does not make the variables available unless a separate process sources or exports the file.

The exposure depends on local filesystem permissions and the security of the user's account. The instructions do not themselves transmit the credentials over the network.

Attack Path

  1. A user follows the documented setup procedure.
  2. The Amazon access key and secret key are written to ~/.env as plaintext.
  3. The file retains default or pre-existing permissions because the instructions do not enforce restrictive access.
  4. A malicious local process, another account with applicable read access, a compromised backup process, or malware operating as the user reads the file.
  5. The attacker e ...[truncated 713 chars]
Remediation
View remediation

Remediation Suggestions

  1. Store long-lived credentials in an operating-system credential manager or another purpose-built secret store.
  2. If a file must be used, place it in a dedicated configuration directory and create it with restrictive permissions before writing secrets:
bash
umask 077
install -m 600 /dev/null ~/.config/amazon-paapi/credentials.env
  1. Avoid repeated >> append operations. Use an atomic configuration update that replaces obsolete credentials and preserves restrictive permissions.
  2. Explicitly load the documented credential source or clearly document how variables must be exported.
  3. Ensure credential files are excluded from source control, logs, diagnostics, backups where inappropriate, and command output.
  4. Recommend narrowly scoped credentials and provide explicit rotation and revocation procedures.
  5. Remove real-looking partner identifiers and secret examples from documentation where they could be mistaken for active values.

T09 · Insecure Skill Coding Practices

Warning
Location
amazon_paapi.py:20
Finding

The client requires sensitive credentials that it does not use for request authentication

Content
View full analysis

Vulnerability Details

File Location: amazon_paapi.py:20-28, amazon_paapi.py:44-69
Vulnerability Type: Unnecessary secret access and incomplete request authentication
Risk Level: Medium

Vulnerable Code

Credential collection at amazon_paapi.py:20-28:

python
def __init__(self):
    self.access_key = os.getenv('AMAZON_ACCESS_KEY')
    self.secret_key = os.getenv('AMAZON_SECRET_KEY')
    self.partner_tag = os.getenv('AMAZON_PARTNER_TAG')
    self.marketplace = 'www.amazon.de'
    self.region = 'eu-west-1'
    self.service = 'ProductAdvertisingAPI'
    
    if not all([self.access_key, self.secret_key, self.partner_tag]):
        raise ValueError("❌ Credentials fehlen! Setze AMAZON_ACCESS_KEY, AMAZON_SECRET_KEY, AMAZON_PARTNER_TAG")

Unsigned network request at amazon_paapi.py:44-69:

python
def _make_request(self, payload):
    """Signierte API Request erstellen"""
    t = datetime.datetime.utcnow()
    amz_date = t.strftime('%Y%m%dT%H%M%SZ')
    date_stamp = t.strftime('%Y%m%d')
    
    host = 'webservices.amazon.de'
    uri = '/paapi5/getitems'
    
    # Headers
    headers = {
        'Host': host,
        'Content-Type': 'application/json; charset=utf-8',
        'X-Amz-Date': amz_date,
        'X-Amz-Target': 'com.amazon.paapi5.v1.ProductAdvertisingAPIv1.GetItems'
    }
    
    # Request body
    body = json.dumps(payload)
    
    # Signature (vereinfacht - in Produktion besser mit aws4auth Library)
    # Für Demo: Direkter Request ohne komplexe Signatur
    
    response = requests.post(
        f'https://{host}{uri}',
        headers=headers,
        data=body,
        timeout=30
    )
    
    return response

Technical Analysis

The constructor retrieves the Amazon access key and secret key and refuses to operate unless both are present. However, _make_request does not use either value. It does not generate or attach an AWS Signature Version 4 Authorization header, even though signing helper functions ...[truncated 2409 chars]

Remediation
View remediation

Remediation Suggestions

  1. Implement complete, tested AWS Signature Version 4 authentication before requiring the access key and secret key.
  2. Construct the canonical request, credential scope, signed headers, signature, and Authorization header according to the Amazon Product Advertising API specification.
  3. Prefer an official or well-maintained signing implementation rather than maintaining incomplete custom cryptographic request logic.
  4. Access each credential only immediately before it is required, avoid copying it unnecessarily, and never include it in exceptions, logs, or diagnostic output.
  5. If the client intentionally remains an unsigned demonstration, remove the access-key and secret-key requirements and clearly state that it is not a functional authenticated PA API client.
  6. Add tests that verify:
    • Requests contain the expected authentication header.
    • Secrets never appear in request bodies, logs, or error output.
    • Requests are sent only to an allowlisted Amazon PA API hostname.
    • Authentication failures do not echo response content containing sensitive data.
  7. Document the exact credential source and use a protected secret-management mechanism rather than a general plaintext environment file.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill presents itself as an 'official' Amazon PA API skill, but the documented behavior relies on undeclared credential access and appears incomplete relative to a proper official PA API client. Misrepresenting functionality and trust level can cause users to provide sensitive Amazon credentials to a skill that may not implement required authentication or security controls correctly.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

This line explicitly instructs storing an Amazon access key in ~/.env, indicating direct credential handling by the skill workflow. Any process, plugin, or accidental disclosure affecting that file could expose API credentials, enabling unauthorized use of the associated Amazon PA API account.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

3. Credentials speichern

bash
echo 'AMAZON_ACCESS_KEY=AKIA...' >> ~/.env
echo 'AMAZON_SECRET_KEY=...' >> ~/.env
echo 'AMAZON_PARTNER_TAG=deinname-21' >> ~/.env

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This line instructs storing the Amazon secret key in plaintext in ~/.env, which is especially sensitive because compromise of the secret enables request signing and impersonation of the account. Plaintext storage in a common environment file materially raises the risk of credential theft via local compromise, backups, sync tools, or inadvertent sharing.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

3. Credentials speichern

bash
echo 'AMAZON_ACCESS_KEY=AKIA...' >> ~/.env
echo 'AMAZON_SECRET_KEY=...' >> ~/.env
echo 'AMAZON_PARTNER_TAG=deinname-21' >> ~/.env

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The partner tag is less sensitive than the access key and secret, but placing it in the same generic ~/.env file normalizes insecure secret handling patterns and may expose affiliate/account metadata unnecessarily. In context, it contributes to poor credential-management hygiene even if the tag alone is not highly sensitive.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

bash
echo 'AMAZON_ACCESS_KEY=AKIA...' >> ~/.env
echo 'AMAZON_SECRET_KEY=...' >> ~/.env
echo 'AMAZON_PARTNER_TAG=deinname-21' >> ~/.env

Limits

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · amazon_paapi.py (reported line 168)May include surrounding context.

python
print("1. Amazon Associates Konto erstellen:")
        print("   https://affiliate-program.amazon.de/")
        print("2. PA API Credentials generieren")
        print("3. In ~/.env speichern:")
        print("   AMAZON_ACCESS_KEY=dein_key")
        print("   AMAZON_SECRET_KEY=dein_secret")
        print("   AMAZON_PARTNER_TAG=dein-tag-21")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of environment-stored credentials and implies network/API access, but does not declare any explicit tool scope or permissions metadata. This creates an authorization and transparency gap: users and platforms cannot accurately assess what resources the skill needs before use, increasing the chance of unintended secret exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup instructions tell users to append Amazon access keys and secret keys directly into ~/.env without any guidance on file permissions, shell history leakage, or secret management hygiene. This encourages insecure credential handling and can lead to accidental disclosure through backups, dotfile sync, overly permissive permissions, or other tools that read the same file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module description is written in German and the implementation is hard-wired to the German Amazon locale elsewhere, but there is no user choice or documented justification for enforcing this locale. This matches the policy category for language/locale constraints without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code advertises itself as an 'official' Amazon PA API client but explicitly skips the required request-signing logic and sends a direct unsigned request instead. This is dangerous because it creates a false sense of correctness and trustworthiness, leading users to rely on a client that will not securely or properly authenticate requests and may encourage insecure copy-paste use in other contexts.

Content

No source excerpt is available for this finding.

Dynamic Request Target

Medium
Category
Server-Side Request Forgery
Confidence
60% confidence
Finding

Request target host is built from a dynamic or untrusted value. If the host is attacker-influenced, this enables SSRF to arbitrary internal or metadata endpoints.

Content

Scanner excerpt · amazon_paapi.py (reported line 64)May include surrounding context.

python
# Signature (vereinfacht - in Produktion besser mit aws4auth Library)
        # Für Demo: Direkter Request ohne komplexe Signatur
        
        response = requests.post(
            f'https://{host}{uri}',
            headers=headers,
            data=body,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation is written entirely in German, beginning with the heading 'Was ist das?' and continuing through setup instructions, without indicating that other languages are available. This can violate language/locale policy when a skill imposes a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

Natural-language content in the skill is predominantly German, including descriptions, commands, setup steps, and notes, while no opt-in or justification for a German-only experience is provided. Under SQP-3, forcing a specific language without user choice or a documented region-specific reason is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest uses German-language natural-language text in the description and command description, with no indication that the skill is intended only for German-speaking users or that language selection is configurable. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.