amazon-sorftime-research-market-skill

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:04 AM UTC
• Version: 1.0.0

Overview

The skill’s product-research workflow is mostly coherent, but it handles API credentials and generated HTML reports in ways users should review before installing.

Review this skill before installing. Use only a low-privilege Sorftime API key, avoid pasting real keys into curl examples, rotate the key if it was exposed in logs or shell history, run it in a project directory where product-research-reports output is acceptable, and be careful opening generated dashboard.html files that include third-party or LLM-derived content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render_dashboard.py:550

Finding

Stored HTML Injection in Generated Dashboards

Content

View full analysis

str: """渲染 VOC 分析""" if not voc_analysis or not voc_analysis.get('dimensions'): return '' dimensions = voc_analysis.get('dimensions', []) summary = voc_analysis.get('summary', '') rows = '' for dim in dimensions: dimension = dim.get('dimension', '') pain_point = dim.get('pain_point', '') frequency = dim.get('frequency', 0) percentage = dim.get('percentage', '') affected_brands = ', '.join(dim.get('affected_brands', [])) brand_opportunity = dim.get('brand_opportunity', '') product_solution = dim.get('product_solution', '') rows += f''' {dimension} {pain_point} {frequency}
{percentage} {affected_brands} {brand_opportunity} {product_solution} ''' summary_html = f'

总结：{summary}

' if summary else '' ``` The same unsafe interpolation pattern is also used for category metadata, product dimensions, cross-analysis data, competitors, barriers, and decision information at `scripts/render_dashboard.py:365-443`, `453-516`, `603-676`, and `782-795`. ### Technical Analysis The renderer inserts values from `data.json` directly into HTML fragments without HTML-context escaping. These values may originate from: - User-supplied product keywords. - Sorftime API responses. - Marketplace product and review content. - LLM-generated analysis. - A locally ...[truncated 1936 chars]

Remediation

View remediation

str: return escape(str(value), quote=True) ``` Apply this function to category names, site values, dates, verdict text, dimensions, review content, brand names, positioning, barrier descriptions, and all other text originating outside the template. 2. Validate numeric fields separately and convert them to expected numeric types before formatting. Do not pass arbitrary strings through numeric display fields. 3. Replace manual string interpolation with a template engine configured for automatic HTML escaping, such as Jinja2 with autoescaping enabled. 4. If rich HTML is intentionally supported, sanitize it with a strict allowlist sanitizer rather than disabling escaping. 5. Add a restrictive Content Security Policy to the generated dashboard. For example, avoid inline scripts and event handlers and restrict network destinations through `default-src`, `script-src`, and `connect-src`. 6. Add regression tests using payloads such as: ```html "> ``` Verify that the generated HTML contains escaped text rather than executable markup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/api_client.py:321

Finding

API Credential Exposed Through Process Arguments and URL Query

Content

View full analysis

tuple: """ 调用 Sorftime API """ self.request_id += 1 payload = { "jsonrpc": "2.0", "id": self.request_id, "method": "tools/call", "params": { "name": tool_name, "arguments": arguments } } try: result = subprocess.run( ['curl', '-s', '-X', 'POST', self.api_url, '-H', 'Content-Type: application/json', '-H', 'Accept: application/json, text/event-stream', '-d', json.dumps(payload)], capture_output=True, text=True, timeout=60, check=True ) ``` The credential is obtained from `.mcp.json` or the `SORFTIME_API_KEY` environment variable at `scripts/api_client.py:58-86`. ### Technical Analysis The Sorftime API key is embedded in a URL query parameter and then passed to `curl` as a command-line argument. While `subprocess.run()` uses an argument array and therefore does not create a shell-injection issue, the complete URL—including the credential—becomes part of the child process command line. Depending on the operating system and local process visibility settings, command-line arguments may be observable through process inspection facilities such as `ps` or `/proc`. Query-string credentials may also be captured by URL-aware proxy logs, diagnostic tooling, telemetry, or server access logs. Unlike a request body or protected authorization ...[truncated 1250 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/collect_data.py:28

Finding

Path Traversal Through Unvalidated Report Directory Components

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically calls out local filesystem search and JSON integrity validation as actual behaviors absent from the top-level purpose statement. Hidden local file access expands the trust boundary and can expose or alter data in ways users did not consent to, which is more security-relevant than mere feature mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language instructions and descriptions are presented in Chinese, which can impose a language constraint on users without any explicit opt-in or alternative locale. The policy requires avoiding forced language or locale unless the user is given a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and documents shell execution, file reads/writes, and environment-backed credential use, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where an invoking agent may grant more capability than users expect, especially given the documented ability to read .mcp.json, write reports/raw API output, and run Python scripts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely in Chinese, and the rest of the skill instructions are also presented in Chinese with no indication that other languages are supported. This can amount to a language policy violation because the skill effectively forces a specific language without giving the user a choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill stores raw API responses and generated research artifacts to disk, but the description does not clearly warn users about persistence. Persisting potentially sensitive business inputs, API outputs, and competitor research without explicit disclosure can create confidentiality and retention risks, especially on shared workstations or synced directories.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The skill documents external transmission to mcp.sorftime.com and includes a debugging example that places the API key directly in the URL query string. Query-string secrets are prone to leakage via shell history, process listings, logs, proxies, and browser/network tooling, making credential exposure more likely during normal use or troubleshooting.

Content

Scanner excerpt · SKILL.md (reported line 603)May include surrounding context.

md

1. **启用详细输出**: 在脚本中添加 `print()` 调试信息
2. **检查原始响应**: 查看 SSE 响应的实际内容
3. **分步执行**: 使用 Python 交互式环境逐行调试
4. **验证API Key**: `curl "https://mcp.sorftime.com?key=YOUR_KEY" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'`

---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This example instructs users to transmit data and authentication material to an external service endpoint, including the API key in the URL. In a research/agent skill context this is expected functionality, but the credential-handling pattern is unsafe because it can leak secrets through operational logging and copied command history.

Content

Scanner excerpt · references/api-quick-reference.md (reported line 8)May include surrounding context.

1. category_name_search - 搜索类目

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"category_name_search","arguments":{"amzSite":"US","searchName":"Sofas"}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation shows an API key being passed in the request URL query string. Query-string credentials are commonly exposed through shell history, browser/proxy/server logs, monitoring tools, and referrer-like telemetry, making accidental credential leakage more likely even if HTTPS is used.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This documented curl command sends product lookup requests to an external endpoint and again embeds the API key in the URL. While the external transmission itself matches the skill's intended purpose, placing credentials in the URL creates avoidable exposure risk via logs, command history, and shared diagnostics.

Content

Scanner excerpt · references/api-quick-reference.md (reported line 44)May include surrounding context.

3. product_detail - 产品详情

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"product_detail","arguments":{"amzSite":"US","asin":"B0DDTCQGTR"}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The reference explicitly documents authenticated requests to an external Sorftime service using an API key, but it does not warn that user-supplied query terms, ASINs, category IDs, and related research inputs will be transmitted off-platform. In an agent skill context, this can cause operators to unknowingly send proprietary product research, business strategy, or customer-derived data to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl example demonstrates sending data directly to an external endpoint with an API key in the request URL, which normalizes external transmission without highlighting privacy, logging, and credential-handling risks. In this skill, research queries and identifiers are core business inputs, so the context makes silent third-party transmission more sensitive than a generic public API example.

Content

Scanner excerpt · references/api-reference.md (reported line 50)May include surrounding context.

示例:

bash

curl -s -X POST "https://mcp.sorftime.com?key={KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file title and description establish the prompt template library as Chinese-language content, and the embedded templates consistently instruct the LLM in Chinese. Because the skill does not offer a language choice or explain a region-specific requirement, this creates a natural-language locale policy concern under the rule for forced language without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The example performs external transmission to a third-party endpoint and includes the API key directly in the request URL. While the network call itself is expected for an API document, embedding credentials in the URL materially raises exposure risk because the full URL may be retained by client-side and server-side logging layers. The skill context increases risk because LLM agents and users may reproduce this exact pattern in operational workflows.

Content

Scanner excerpt · references/sorftime-mcp-api.md (reported line 5)May include surrounding context.

调用方式

bash

curl -s -X POST "https://mcp.sorftime.com?key={API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":N,"method":"tools/call","params":{"name":"TOOL_NAME","arguments":{...}}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs users to place the API key in the URL query string. Query parameters are commonly captured in browser history, shell history, logs, proxies, monitoring systems, and upstream infrastructure, which increases the chance of credential exposure even when HTTPS is used. In the context of an agent skill that will be copied into automation and tool integrations, this pattern is more dangerous because it encourages repeated insecure handling of live credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The document explicitly demonstrates transmitting an API credential to an external service endpoint, and the credential is embedded in the request URL. Even though the destination appears expected for the skill, this creates a real risk of secret leakage via logs, monitoring systems, shell history, and copied command snippets; the skill context makes it somewhat less suspicious but not safe.

Content

Scanner excerpt · references/troubleshooting.md (reported line 87)May include surrounding context.

检查:

bash

# 验证 API Key
curl "https://mcp.sorftime.com?key=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language instructions, examples, docstrings, and command-line help in Chinese only, with no alternate language option or indication that the skill is region-specific. That creates a language/locale policy issue because users are forced into a single language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a product-research skill focused on analysis and reporting via Sorftime MCP, but this file also implements credential discovery by reading .mcp.json and environment variables. Accessing local configuration and environment secrets is a broader capability than the research/analysis purpose itself and is not stated in the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Using Sorftime MCP for data collection is expected, but this implementation reaches it by spawning the curl binary via subprocess rather than using a constrained MCP/runtime client. Subprocess execution is a distinct capability that is not justified by the manifest's research-and-analysis scope and expands what the skill can do at runtime.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_client.py (reported line 356)May include surrounding context.

python

}

        try:
            result = subprocess.run(
                ['curl', '-s', '-X', 'POST', self.api_url,
                 '-H', 'Content-Type: application/json',
                 '-H', 'Accept: application/json, text/event-stream',

Static analysis

No suspicious patterns detected.