Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.31.0 beautifulsoup4>=4.12.0 pandas>=2.0.0 numpy>=1.24.0
- Confidence
- 96% confidence
- Finding
- requests>=2.31.0
Security audit
Amazon Fba Finder
Security checks across malware telemetry and agentic risk
Overview
This skill does not show data theft or destructive behavior, but its advertised live Amazon and supplier research features are mostly unfinished while users may pay for it and provide API keys.
Review before installing or paying. The main risk is not malware-like behavior; it is that the skill markets real-time product discovery and supplier recommendations while the provided code appears to be a prototype. Do not place API keys in prompt-visible files such as TOOLS.md, and do not rely on this tool for business decisions unless the publisher provides working, verifiable data integrations and pinned dependencies.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.31.0 beautifulsoup4>=4.12.0 pandas>=2.0.0 numpy>=1.24.0 python-dotenv>=1.0.0
- Confidence
- 96% confidence
- Finding
- beautifulsoup4>=4.12.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.31.0 beautifulsoup4>=4.12.0 pandas>=2.0.0 numpy>=1.24.0 python-dotenv>=1.0.0 aiohttp>=3.9.0
- Confidence
- 95% confidence
- Finding
- pandas>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
requests>=2.31.0 beautifulsoup4>=4.12.0 pandas>=2.0.0 numpy>=1.24.0 python-dotenv>=1.0.0 aiohttp>=3.9.0
- Confidence
- 95% confidence
- Finding
- numpy>=1.24.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
beautifulsoup4>=4.12.0 pandas>=2.0.0 numpy>=1.24.0 python-dotenv>=1.0.0 aiohttp>=3.9.0
- Confidence
- 94% confidence
- Finding
- python-dotenv>=1.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
pandas>=2.0.0 numpy>=1.24.0 python-dotenv>=1.0.0 aiohttp>=3.9.0
- Confidence
- 96% confidence
- Finding
- aiohttp>=3.9.0
Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
- requests
Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more
Critical
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
- numpy
Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
- aiohttp
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.