amazon-scraper

• Outcome: Review
• Latest audit: Oct 2, 2026 · 7:47 AM UTC
• Version: 4.0.1

Overview

This is mostly a disclosed Amazon scraping skill, but it also includes broader generic scraping and optional logged-in Chrome control that users should review carefully before installing.

Install only if you are comfortable with a scraper that can use paid proxies, store scraping state, and optionally control a logged-in local Chrome session. Keep CDP bound to 127.0.0.1, do not expose it, use dedicated Amazon/proxy accounts, and avoid the generic mode unless you intentionally want arbitrary-site scraping.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (126)

Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cdp_fallback_scrape.py (reported line 40)May include surrounding context.

python

"""Open our own tab rather than driving one the user is working in."""
    try:
        req = Request(f"{CDP_URL}/json/new?about:blank", method="PUT")
        tab = json.loads(urlopen(req, timeout=10).read())
    except Exception:
        tab = json.loads(urlopen(f"{CDP_URL}/json/new?about:blank", timeout=10).read())
    return tab["webSocketDebuggerUrl"], tab["id"]

Tainted flow: 'CDP_URL' from os.environ.get (line 27, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cdp_fallback_scrape.py (reported line 42)May include surrounding context.

python

req = Request(f"{CDP_URL}/json/new?about:blank", method="PUT")
        tab = json.loads(urlopen(req, timeout=10).read())
    except Exception:
        tab = json.loads(urlopen(f"{CDP_URL}/json/new?about:blank", timeout=10).read())
    return tab["webSocketDebuggerUrl"], tab["id"]

Tainted flow: 'CDP_URL' from os.environ.get (line 27, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cdp_fallback_scrape.py (reported line 48)May include surrounding context.

python

def close_tab(target_id):
    try:
        urlopen(f"{CDP_URL}/json/close/{target_id}", timeout=10).read()
    except Exception as e:
        print(f"warning: could not close scratch tab: {e}", file=sys.stderr)

Tainted flow: 'CDP_URL' from os.environ.get (line 27, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cdp_fallback_scrape.py (reported line 175)May include surrounding context.

python

print(f"Total ASINs: {len(asins)}")
    try:
        urlopen(f"{CDP_URL}/json/version", timeout=10)
    except Exception as e:
        print(f"ERROR: Chrome CDP not reachable at {CDP_URL}: {e}", file=sys.stderr)
        sys.exit(1)

Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/scrape_reviews.py (reported line 41)May include surrounding context.

python

"""
    req = urllib.request.Request(f"{CDP_BASE}/json/new?about:blank", method="PUT")
    try:
        tab = json.loads(urllib.request.urlopen(req, timeout=10).read())
    except Exception:
        # Older Chrome builds still accept GET on /json/new.
        tab = json.loads(urllib.request.urlopen(f"{CDP_BASE}/json/new?about:blank", timeout=10).read())

Tainted flow: 'CDP_BASE' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/scrape_reviews.py (reported line 44)May include surrounding context.

python

tab = json.loads(urllib.request.urlopen(req, timeout=10).read())
    except Exception:
        # Older Chrome builds still accept GET on /json/new.
        tab = json.loads(urllib.request.urlopen(f"{CDP_BASE}/json/new?about:blank", timeout=10).read())
    return tab["webSocketDebuggerUrl"], tab["id"]

Tainted flow: 'CDP_BASE' from os.environ.get (line 28, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/scrape_reviews.py (reported line 50)May include surrounding context.

python

def close_tab(target_id):
    try:
        urllib.request.urlopen(f"{CDP_BASE}/json/close/{target_id}", timeout=10).read()
    except Exception as e:
        print(f"warning: could not close scratch tab {target_id}: {e}", file=sys.stderr)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as a containerized Docker+Playwright scraper, but documentation also directs use of a local logged-in Chrome session over CDP for review scraping and fallback collection. That materially expands the trust boundary to the host browser session and local debugging interface, creating access to authenticated state not reflected in the declared design.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a containerized Docker+Playwright scraper, but documentation also directs use of a local logged-in Chrome session over CDP for review scraping and fallback collection. That materially expands the trust boundary to the host browser session and local debugging interface, creating access to authenticated state not reflected in the declared design.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

md

### 1. Amazon模式 (`amazon_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

### 2. 通用模式 (`main_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

### 2. 通用模式 (`main_handler.js`)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

### 2. 通用模式 (`main_handler.js`)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill should not be used for unrelated sites, yet the documentation adds a broad generic mode for arbitrary websites. This scope expansion weakens policy enforcement and can turn an Amazon-specific scraper into a general-purpose web access tool with wider abuse potential.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

md

优先级（`assets/proxy.js`，环境变量优先）：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

- `references/new-layout-fixes-2026-07.md` — Amazon 新版页面 DOM 变化 + 修复详情（seller 字段、BSR 提取、brand 清理、proxy 切换）

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The handler accepts any command-line argument starting with http as the target URL and does not restrict it to Amazon domains, despite the skill being documented as Amazon-specific. This creates a generic browser-based scraping primitive that can be repurposed to fetch arbitrary sites through paid residential/ISP proxies, expanding the skill beyond its stated purpose and increasing the risk of abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.