Amazon Review Scraper

• Analyzed: Apr 2, 2026, 3:11 AM
• Findings: 1
• Version: 1.0.0
• Hash: ec8c6c898d92ea0977996cd4a9a41a90c787b5467b5aa80e253e043f5e69801b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains several high-risk vulnerabilities and behaviors. The main entry point `voc.sh` is vulnerable to shell injection because it passes unquoted variables ($SCRAPE_ARGS) to a python3 command, which could allow arbitrary code execution if parameters like the API token are manipulated. Additionally, `analyze.py` passes untrusted review data into the `claude` CLI using the `--dangerously-skip-permissions` flag, creating a high risk of indirect prompt injection. Finally, `scraper.py` performs unauthorized environment modification by automatically executing `pip install` to fetch dependencies.