Security audit

Amazon Best Sellers API

Security checks for vulnerabilities and agentic risk

Overview

This is a focused Amazon best-sellers API wrapper, but it passes the user's JustOneAPI token through URLs and command-line arguments where it may be exposed in logs or process metadata.

Review this before installing if the JustOneAPI token has meaningful quota, billing, or account access. Use a narrowly scoped or disposable token if available, avoid running it in shared shells or CI logs, and rotate the token if you suspect command-line or URL logging captured it.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: bin/run.mjs:243
Finding: API Credential Transmitted in a URL Query Parameter
Content: View full analysis
item.location === "query")) { const value = params[parameter.name]; if (value === undefined) { continue; } appendValue(url.searchParams, parameter.name, value); } } ``` ### Technical Analysis The operation manifest declares the authentication token as a query parameter. The runtime injects the supplied token into `params`, and `applyQueryParams` subsequently appends every query parameter—including `token`—to the request URL before calling `fetch`. Although the URL uses HTTPS and the destination is hard-coded as `https://api.justoneapi.com`, HTTPS protects the request only while it is in transit. Query strings may still be retained in: - API server access logs - Reverse-proxy and gateway logs - Network monitoring or application-performance systems - Debugging and error telemetry - Request tracing systems that record complete URLs The request is necessary for the Skill's declared API-wrapper functionality, and the audit found no evidence that the credential is sent to an unrelated destination. However, transmitting authentication secrets in URLs is not a least-exposure design because URLs are commonly ...[truncated 1091 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: bin/run.mjs:176
Finding: API Credential Exposed Through Process Command-Line Arguments
Content: View full analysis
"}' ``` ```md - Pass the token with `--token "$JUST_ONE_API_TOKEN"`; do not paste token values into chat messages, screenshots, or logs. ``` ```js if (flag === "--token") { parsed.token = value; index += 1; continue; } ``` ### Technical Analysis The documented invocation expands `JUST_ONE_API_TOKEN` into a `--token` command-line argument. This places the secret in the Node.js process argument vector. Depending on the operating system, container configuration, user permissions, and monitoring environment, process arguments may be available through: - Process-listing and inspection tools - `/proc` process metadata on Linux systems - Endpoint monitoring and audit systems - CI/CD job telemetry - Shell tracing such as `set -x` - Process crash or diagnostic reports The code does not print the token directly, and exposure to unrelated unprivileged users may be restricted on hardened systems. Nevertheless, command-line arguments are an avoidable credential channel because the Skill already declares `JUST_ONE_API_TOKEN` as its required environment variable. ### Attack Path 1. A user follows the documented command and supplies `--token "$JUST_ONE_API_TOKEN"`. 2. The shell expands the environment variable into the process argument vector. 3. While the helper is running, a local process observer or monitoring system records its arguments. 4. An attacker with access to that process metadata or telemetry extracts the token. 5. The attacker reuses the credential against JustOneAPI within the token's authorized scope. This path requires local process-observation privileges, access to audit or ...[truncated 499 chars]
Remediation: View remediation
"}' ``` 3. Remove support for `--token`, or retain it only as a deprecated compatibility option accompanied by an explicit warning. 4. For environments where environment variables are unsuitable, accept the credential through protected standard input or a permission-restricted credential file rather than through the argument vector. 5. Disable shell tracing around secret initialization and execution, and ensure CI/CD systems mask the token in logs and diagnostic output. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a networked API via a Node helper but does not declare any explicit tool scope such as allowed network access or permitted tools. That creates a permission-transparency gap: an agent or reviewer cannot easily constrain or verify what external access the skill is expected to use, increasing the risk of overbroad outbound requests or misuse if the helper implementation changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Passing an authentication token in a query parameter is risky because query strings are commonly logged by clients, proxies, gateways, browser history, and observability systems. Even over HTTPS, the token may be exposed through logs or error traces, increasing the chance of credential leakage and unauthorized API use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to pass an authentication token in the query string, which is commonly exposed in browser history, proxy logs, analytics, referrer headers, and server access logs. Even though this file is only documentation, normalizing query-parameter credentials encourages insecure usage patterns that can lead to credential leakage and unauthorized API use.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a manifest file, so vague-trigger review applies. The file identifies the skill by name and slug but provides no explicit trigger scope, negative examples, or invocation constraints, making it unclear how narrowly the skill should be activated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.