Amazon After Sales Flow Luoqianchenguni Max

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 0.1.1

Overview

This skill is not clearly malicious, but it can control a logged-in Amazon browser, capture order/message data, persist browser state, and send messages with thin runtime guardrails.

Install only if you are comfortable giving this skill control of a logged-in Amazon browser session. Use draft-only mode unless you deliberately intend to send, review any message before setting confirm_send, avoid evidence/export or generic form-filler actions on pages with unrelated sensitive data, and periodically clear the local .browser-profile and artifacts directories if you do not want sessions or captured page data retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This runtime exposes a broad browser-automation layer beyond a narrowly scoped Amazon task runner: arbitrary navigation within amazon.* pages, DOM extraction, generic clicking/typing, scrolling, and screenshot capture. In an agent setting, that creates a powerful capability surface for scraping order data, harvesting page contents, and performing unintended actions, especially because the dispatcher executes tool calls derived from skill names and user-supplied arguments.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The code presents a security-oriented response for direct URL input, but it still accepts JSON actions and natural-language triggers that dispatch browser-driving flows such as order opening, contact flow, and full after-sales automation. This mismatch can mislead integrators or users into thinking browser-opening behavior is blocked when it is only blocked for one input shape, increasing the chance of unintended automation or policy bypass.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The manifest description is too broad to clearly constrain when this skill should be invoked, while the input accepts an arbitrary `detailsUrl` and the skill can read DOM content from the active authenticated browser session. That combination can cause the agent to run the skill on unintended pages and extract purchase-related data from a logged-in Amazon session, increasing the risk of overcollection or misuse of sensitive order information.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The manifest describes a skill that extracts Amazon order data and may open an order-details link, but it does not define clear activation constraints, user-confirmation requirements, or page/host restrictions. In an agent environment, broad invocation wording can cause the skill to run in unintended contexts and perform sensitive browsing actions against purchase-history pages without adequate scoping.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill is explicitly designed to capture screenshots and DOM snippets, which can contain sensitive information such as account data, tokens, personal details, or internal application state. There is no indication of user warning, consent gating, redaction, or scope restriction, so the skill could collect more page data than intended and expose it through stored artifacts or downstream processing.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The entry skill is exposed through a very broad natural-language description for 'Amazon full-flow automation' without clear trigger boundaries, user-intent checks, or scope limits. In a skill that can open orders, fetch details, run contact flows, and draft/send seller messages, vague invocation text increases the chance of overbroad activation and unintended execution of sensitive actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code can automatically send messages through marketplace/contact interfaces when autoSend is enabled, and the actual send action is performed by DOM heuristics without any local interactive confirmation step at execution time. Even though resolveAutoSend requires certain flags, this is still risky in an agent context because a caller can trigger outbound communication, causing unauthorized messages, spam, or socially engineered seller interactions on behalf of the user.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The screenshot tool writes page or element captures to disk in an artifacts directory without any consent, classification, or minimization controls. On Amazon order and messaging pages, screenshots may contain PII, addresses, order history, or conversation content, so silent persistence materially increases data-exposure risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The runtime launches a persistent Chromium context using a fixed on-disk profile directory, which can retain session cookies, authentication state, browsing history, and other sensitive browser data across runs. In an agent environment, this persistence expands the blast radius of compromise and enables later tasks or code paths to act with previously stored authenticated sessions without renewed user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Natural-language phrases such as 'run amazon-after-sales-flow' are enough to construct a full-flow payload and invoke runFullFlow, with optional auto-send behavior inferred from text. In an agent context, this creates a prompt-to-action path for external or ambiguous text to trigger consequential browser automation and possible message sending without an explicit confirmation gate in this file.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.