amazon-research-reviews-skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.0.0

Overview

The skill matches its review-analysis purpose, but it needs Review because it can automatically install a Python package and leave extra local copies of review data without clear disclosure.

Review before installing. Use it only on review files you intentionally select, avoid sensitive or personal data unless you are comfortable with local copies being created, preinstall and pin openpyxl yourself if you need Excel support, and inspect or delete generated prompt/sample/output files before sharing or committing the workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

import openpyxl
        except ImportError:
            print("📦 正在安装 openpyxl...")
            os.system("pip install openpyxl -q")
            import openpyxl

        print(f"🔄 检测到 Excel 文件，正在转换为 CSV...")

• Confidence: 98% confidence
• Finding: The code executes a shell command at runtime to install a package using `os.system("pip install openpyxl -q")`. Invoking a shell from application logic is dangerous because it introduces command-execution behavior, depends on ambient PATH/pip configuration, and can trigger unreviewed network access and package installation in the execution environment. In the context of a review-analysis skill, this behavior is unnecessary at runtime and expands the attack surface significantly.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The prompt mandates emission of a hidden machine-readable <strategic_json> block that goes beyond the visible review-analysis report. This creates a covert secondary output channel that can exfiltrate enriched business intelligence or be consumed by downstream systems without clear user awareness, increasing the risk of data over-collection and unintended automation on sensitive strategic content.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill expands from comment analysis into prescriptive business strategy, execution directives, and ROI planning, which exceeds the stated review-analysis scope. This scope creep can cause downstream agents or users to over-trust speculative strategic recommendations as grounded analysis, and it increases the sensitivity of generated outputs by transforming raw reviews into actionable commercial strategy.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The utility persists both the generated AI prompt and sampled CSV review data to local files, which can unintentionally create a secondary data store containing potentially sensitive customer content. In a review-analysis skill, silently exporting or retaining samples increases privacy and data-handling risk, especially if the host environment is shared, monitored, or lacks retention controls.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill metadata says analysis quantity must be collected via AskUserQuestion before execution, but the controller silently defaults ANALYSIS_COUNT to 100 and continues. This bypasses an explicit user-consent/control requirement and can cause unintended processing volume, cost, or data handling without the required interaction step.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The processor performs dependency installation during normal file handling, which is outside the stated purpose of parsing CSV/Excel review data. This creates unexpected side effects: network egress, code retrieval from package indexes, and execution of installer logic, all of which are risky in an agent skill that may process untrusted user-supplied files. The skill context makes this more dangerous because users would not reasonably expect file analysis to mutate the environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly states that raw review data and derived analysis artifacts will be written to output files, but it provides no warning about privacy, retention, or handling of usernames and other potentially identifying fields. In a skill that processes user-generated content at scale, this increases the risk of unintended storage, sharing, or downstream exposure of personal or sensitive data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly preserves original review data and generates labeled outputs, but it gives no privacy or data-handling warning. If review files contain usernames, free-text personal data, or sensitive customer content, the skill may replicate that information into multiple derivative files and increase exposure, especially on shared workstations or repos.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code prints the constructed prompt containing CSV headers and sample review rows directly to stdout for external AI use, which can leak potentially sensitive review data into terminal logs, CI logs, shell history capture, or screen recordings. Because the content is explicitly meant to be shared with an AI, this creates a real data-exposure path without any warning, redaction, or consent gate.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Writing sampled CSV data to a local JSON debug file creates an unannounced copy of potentially sensitive review text on disk. This expands the attack surface through leftover artifacts, accidental commits, backups, or access by other local users/processes, which is especially risky in data-analysis workflows handling customer-generated content.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The controller writes CSV-derived review content into prompt files on disk, creating an intermediate export of potentially sensitive or proprietary review data. In the skill context, this is more concerning because e-commerce reviews may contain personal data, order details, or other user-generated content that operators may not expect to be persisted outside the source CSV.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The extract action emits full review bodies as JSON to stdout, which can disclose potentially sensitive or regulated text content to logs, calling processes, or downstream tools without any explicit consent or warning. In an AI-driven review-analysis skill, this is more dangerous because raw user-generated content may include personal data, contact details, or other unexpected sensitive information and is likely to be forwarded into additional systems.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script logs formatted review content to stdout during processing, which can expose potentially sensitive user-generated text in terminal history, CI logs, or centralized logging systems. In a review-analysis skill, review bodies may contain names, contact details, order references, or other personal data, so indiscriminate logging increases privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.