Buy from Amazon — Search, Cart & Order for AI Agents

• Outcome: Pass
• Latest audit: May 28, 2026, 1:25 PM
• Version:
  1.2.4

Overview

This is a disclosed Amazon-shopping helper that sends product searches, cart details, shipping address, and email to buystuff.ai so users can receive a payment link.

Install only if you are comfortable using buystuff.ai as an intermediary for Amazon purchases and sharing shipping and email details with it. Before approving a payment link, confirm the exact product, total price including the 10% service fee, shipping address, recipient, and email.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation guidance is broad enough to trigger the purchasing skill for generic shopping, recommendation, or gift-related requests before the user has clearly asked to place an order. In a commerce skill that can create carts, collect shipping/email, and send payment links, over-invocation increases the chance of unintended data collection or transactional progression.

VirusTotal

64/64 vendors flagged this skill as clean.