amazon-sorftime-research-keywords-skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:04 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-built for Amazon keyword research, but it needs Review because it handles API credentials, external business data, and generated reports in ways that are under-scoped and insecure.

Install only if you are comfortable sending ASIN, keyword, and product research data to Sorftime and storing the resulting reports locally. Keep .mcp.json in a trusted project location, verify it points only to the intended Sorftime endpoint, protect or rotate the API key, and avoid opening generated HTML/CSV files from untrusted API or product data until escaping and spreadsheet-cell sanitization are fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_html_dashboard.py:51

Finding

Stored HTML and JavaScript Injection in Generated Dashboard

Content

View full analysis

ASIN: {{ASIN}} | Product: {{PRODUCT_NAME}} | Site: {{SITE}} | Generated: {{DATE}} ``` ### Technical Analysis The dashboard generator performs direct string replacement without HTML or attribute escaping. The affected values include: - `asin`, supplied through command-line input or parsed from a report directory name - `site`, supplied through command-line input or parsed from a report directory name - `product_name`, obtained from user-supplied product JSON, remote API data, or inferred keyword data Because these values are inserted into both HTML text and the `href` attribute, an attacker can terminate the surrounding context and inject arbitrary HTML or JavaScript. For example, a malicious product name containing: ```html

``` would be embedded directly in the generated `dashboard.html`. Keyword table cells are separately escaped, but that protection does not cover these top-level template substitutions. ### Attack Path 1. An attacker controls a product-information JSON file, a Sorftime API response, or an accepted command-line value. 2. The attacker places an HTML or script payload in `product_name`, `asin`, or `site`. 3. T ...[truncated 865 chars]

Remediation

View remediation

`, quotes, event handlers, and attribute terminators. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/csv_generator.py:84

Finding

Spreadsheet Formula Injection in Generated CSV Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/keyword_collector.py:54

Finding

API Credential Exposure Through Process Command-Line Arguments

Content

View full analysis

str: """Read API URL from .mcp.json""" project_root = os.path.dirname(os.path.dirname(os.path.dirname(SCRIPT_DIR))) mcp_file = os.path.join(project_root, '.mcp.json') if not os.path.exists(mcp_file): cwd = os.getcwd() while cwd != os.path.dirname(cwd): mcp_file = os.path.join(cwd, '.mcp.json') if os.path.exists(mcp_file): break cwd = os.path.dirname(cwd) try: with open(mcp_file, 'r', encoding='utf-8') as f: config = json.load(f) return config['mcpServers']['sorftime']['url'] ``` Project documentation defines that URL as containing the API key in its query string. The full URL is then passed to `curl` as a process argument: ```python cmd = [ 'curl', '-s', '-X', 'POST', self.api_url, '-H', 'Content-Type: application/json', '-d', f'{{"jsonrpc":"2.0","id":{self.request_id},"method":"tools/call","params":{{"name":"{tool_name}","arguments":{args_str}}}}}' ] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=self.REQUEST_TIMEOUT, encoding='utf-8', errors='ignore') ``` ### Technical Analysis The documented Sorftime endpoint follows this form: ```text https://mcp.sorftime.com?key=API_KEY ``` Consequently, the API credential becomes part of the `curl` command line. Although `subprocess.run()` uses an argument array and does not invoke a shell, this only prevents shell injection; it does not protect command-line arguments from observation. Depending on the operating system and host configuration, process arguments may be visible throug ...[truncated 1124 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/generate_html_dashboard.py:324

Finding

External Chart.js Dependency Loaded Without Subresource Integrity

Content

View full analysis

``` ### Technical Analysis The dependency version is pinned to Chart.js 4.4.0, which reduces unintended version changes. However, the browser is still instructed to trust and execute the response delivered by the CDN at report-viewing time. The script tag does not provide a Subresource Integrity `integrity` attribute. Therefore, the browser has no cryptographic mechanism to verify that the downloaded JavaScript matches the code expected when the Skill was audited. This code is in the fallback template returned by `get_default_template()`, so it is used when the packaged dashboard template cannot be found. ### Attack Path 1. The normal dashboard template is unavailable, causing `get_default_template()` to be used. 2. The generated report includes the external jsDelivr script reference. 3. A user opens the dashboard while connected to the network. 4. The browser downloads Chart.js from the referenced CDN. 5. If the CDN account, package distribution path, or delivery infrastructure is compromised, the browser receives substituted JavaScript. 6. Because no integrity hash is present, the browser executes the substituted code. ### Impact Assessment Compromised dependency delivery could permit arbitrary JavaScript execution in the generated dashboard. The malicious script could: - Read and alter report content - Falsify charts or keyword recommendations - Display phishing content - Send rendered report information to an external server - Initiate additional network requests from the browser The scope is limited to dashboards generated with the fallback tem ...[truncated 61 chars]

Remediation

View remediation

``` 3. Obtain the hash from a trusted release artifact and verify it independently before deployment. 4. Apply a Content Security Policy restricting script sources to the local package and the explicitly approved CDN. 5. Ensure the normal packaged template and fallback template use identical dependency controls. 6. Include third-party JavaScript artifacts in dependency inventory, integrity checking, and update-review procedures. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code is related to the declared domain of Amazon keyword research and Sorftime MCP data collection, so the core collection aspect matches partially. However, the declared description promises substantially more functionality than shown here: intelligent LLM-based classification into eight categories and generation of multiple output artifacts. This code only collects and deduplicates keywords, retrieves product details, performs basic heuristic extraction of materials/features/use cases from product text, and prints console output. Those heuristics are not equivalent to the declared 8-dimension keyword classification. Additionally, the described slash-command trigger is not implemented in this chunk; the actual interface is a Python CLI main(). Therefore the description materially overstates the implemented behavior in this supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

声明描述的是一个端到端的关键词研究与分类技能：采集关键词、分类并输出 Markdown/CSV/HTML。实际代码片段仅是“重新生成 Markdown 和 HTML 报告，跳过 CSV”的辅助/后处理脚本。它依赖本地已存在的 keywords_raw.json 和分类结果，不展示任何数据采集过程，也不生成 CSV，且输入是硬编码值而非用户触发参数。因此，这段代码的实际主要行为与声明的完整技能目的存在明显偏差。虽然它与声明主题相关（关键词分类结果的报告生成），但作为所提供代码片段，其功能范围明显更窄且不同，构成描述与行为不一致。

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

The code walks parent directories and trusts the first .mcp.json it finds, then uses its sorftime URL as the network endpoint. In a hostile or multi-tenant environment, an attacker who can place or influence that file could redirect requests to an arbitrary server, causing SSRF-like outbound connections, data exfiltration of queried ASIN/site data, or malicious response injection into downstream processing.

Content

Scanner excerpt · scripts/keyword_collector.py (reported line 54)May include surrounding context.

python

print(f"  [{timestamp}] [{level}] {message}")

    def _get_api_url(self) -> str:
        """从 .mcp.json 读取 API URL"""
        # 获取项目根目录
        project_root = os.path.dirname(os.path.dirname(os.path.dirname(SCRIPT_DIR)))
        mcp_file = os.path.join(project_root, '.mcp.json')

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/workflow.py (reported line 576)May include surrounding context.

python

站点: {self.site}
"""

        return prompt

    def _format_product_info(self, product_info: dict) -> str:
        """格式化产品信息"""

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation is written entirely in Chinese, including usage, warnings, and troubleshooting, with no indication that users may choose another language or that the skill is region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documents shell execution, environment access, and file read/write behavior but does not declare any tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and makes it easier for the skill to access sensitive files, environment variables, or run unintended commands if invoked automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to send ASIN, keyword, and related product research data to an external Sorftime endpoint and to generate local report artifacts, but it does not clearly warn about this data transmission and persistence. In agent-driven environments, missing disclosure can lead to unintentional sharing of sensitive business intelligence or accumulation of local files containing proprietary keyword research.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The documented workflow sends input data to an external API endpoint, including product identifiers and keyword research context. External transmission is risky when not tightly governed because it can expose confidential market intelligence, and the use of an API key in the URL also increases the chance of credential leakage via logs, shell history, or proxy records.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

Step 1.1: 获取产品流量词

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"product_traffic_terms","arguments":{"amzSite":"US","asin":"ASIN"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The generic call format normalizes repeated external transmission to Sorftime and reinforces passing the API key in the URL, creating a reusable pattern for data and secret exposure. Even if the transmitted content is business rather than personal data, repeated unsafeguarded exfiltration of research inputs and outputs can leak proprietary commercial information.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

调用格式

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{"amzSite":"US","KEY":"VALUE"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The file is explicitly designed around making external HTTP requests to mcp.sorftime.com, including sending ASINs, keywords, and API credentials. External transmission is expected for this skill, but it remains security-relevant because the documentation normalizes network egress and third-party data disclosure without clear trust-boundary, data-classification, or secret-handling guidance.

Content

Scanner excerpt · references/api-tools-reference.md (reported line 1)May include surrounding context.

md

# Sorftime MCP 工具参考 (curl 调用格式)

**注意**：Sorftime MCP 使用 SSE 协议，所有工具调用格式如下：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document provides ready-to-run curl examples that send an API key in the URL query string and transmit product/keyword inputs to an external service, but it does not clearly warn users that this causes outbound network requests and may expose credentials in shell history, logs, proxies, or screenshots. In an agent skill context, such examples can be copied directly into automation, increasing the chance of unintended secret leakage and unreviewed third-party data transfer.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sorftime-mcp-api.md (reported line 5)May include surrounding context.

调用方式

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

该 Markdown 文件包含实际的网络调用示例，并将 API key 作为 URL 查询参数传输。文档没有任何用户警示说明此调用会向外部服务发送请求，也没有提醒查询参数中的密钥可能出现在 shell 历史、代理日志或监控记录中。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The referenced MCP documentation exposes state-changing keyword library operations such as adding, moving, and deleting favorites that are unrelated to the stated purpose of generating keyword research reports. Including unnecessary write-capable tools expands the skill’s attack surface and creates a path for unintended or prompt-induced modification of a user’s account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented capability to delete saved keywords is destructive and no warning, confirmation, or authorization flow is described. In an agent setting, this creates a realistic risk of accidental deletion through ambiguous prompts, prompt injection, or model misinterpretation, causing loss of curated keyword data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language strings, docstrings, and CLI usage text exclusively in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when they are optional or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code’s top-level natural-language description states the parser is a Chinese-specific '关键词专用版本', and the surrounding docstrings/comments consistently assume Chinese-language data handling. Under the policy, forcing a specific language or locale without user opt-in or a clearly documented regional justification is a reportable natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML template sets <html lang="zh-CN">, and the surrounding UI text throughout the file is Chinese-only. For a general-purpose dashboard generator, this forces a specific language/locale without user opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains natural-language strings and documentation entirely in Chinese, including the module description and all user-facing report content. The skill does not offer a language choice or explain that it is intentionally limited to a Chinese-speaking context, which creates a locale policy concern under the language/opt-in rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language descriptions, usage text, logs, and CLI output in Chinese, which effectively forces a specific language for users. The file does not provide any user opt-in, alternative locale, or justification that the skill is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/keyword_collector.py (reported line 101)May include surrounding context.

python

]

        try:
            result = subprocess.run(cmd, capture_output=True, text=True,
                                   timeout=self.REQUEST_TIMEOUT, encoding='utf-8', errors='ignore')
            response = parse_sse_response(result.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code writes the full LLM classification prompt to disk, and that prompt includes collected keywords plus product information. This creates an unnecessary local persistence point for potentially sensitive business data, increasing exposure through other local users, backups, or later unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow saves raw keyword data, CSVs, Markdown reports, HTML dashboards, and related product-derived analysis outputs to disk without an explicit consent or warning mechanism. In this skill context, the data is likely commercial research rather than code, but it may still be sensitive and its broad persistence materially increases the chance of local disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML document declares lang="zh-CN", and the visible interface text throughout the template is in Chinese. This creates a natural-language locale constraint with no opt-in, alternative language path, or documented regional justification, which matches the policy-violation category for language/locale restrictions.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file includes free-form triggers such as “分析这个产品的关键词词库” and “调研 B07PWTJ4H1 的关键词,” which are broader than the explicit slash command and could overlap with ordinary discussion about keyword analysis. The section does not provide negative examples or constraints clarifying that activation should be limited to Amazon ASIN keyword-research requests.

Content

No source excerpt is available for this finding.