T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:14- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Amazon Search
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent Amazon-search purpose, but its implementation uses unsafe browser automation, cookie handling, and shell execution patterns that need review before installation.
Review carefully before installing. Run it only in an isolated, unprivileged environment, avoid using it while logged into Amazon, do not pass untrusted keywords or proxy values, and clear `cache/sessions`, `resultscache`, `results`, and image caches after use. Prefer a version that removes `curl | bash`, uses non-shell process spawning, keeps Chromium sandbox/security defaults, and avoids printing or persisting cookies.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/amazon_search.ts:8- Finding
Shell Command Injection Through the Search Keyword
- Content
View full analysis
{ console.log(`Using Playwright to search Amazon...`); let cmd = `npm run psearch -- "${keyword}" --pages=${pages}`; if (proxy) { cmd += ` --proxy=${proxy}`; } const output = execSync(cmd, { encoding: "utf-8", timeout: 300000, // 5分钟超时 cwd: __dirname }); ``` The keyword originates from the command line: ```ts const keyword = positionalArgs[0] || "shirt"; ``` ### Technical Analysis A user-controlled search keyword is interpolated into a command string that is passed to `child_process.execSync`. This API executes the string through a shell. Wrapping the keyword in double quotes does not make the command safe. Shell command substitution such as `$(...)` and backticks is still processed inside double quotes. An input containing a closing quote can also terminate the intended argument and introduce shell operators or additional commands. For example, a keyword containing shell command-substitution syntax would be evaluated by the shell before `npm` receives the argument. No validation can reliably make arbitrary text safe for shell-string construction; the process must be launched without a shell. ### Attack Path 1. An attacker supplies or persuades a user or agent to use a crafted search keyword. 2. The keyword reaches `searchWithPlaywright` without shell-safe argument separation. 3. The value is interpolated into the `cmd` string. 4. `execSync` invokes a shell to parse the command. 5. The shell evaluates command substitutions, quote termination, or injected operators. 6. The injected command executes with the privileges and environment of the Skill process. ### Impact Assessment Successful exploitation prov ...[truncated 328 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/amazon_search.ts:10- Finding
Shell Command Injection Through the Proxy Environment Variable
- Content
View full analysis
`. 5. `execSync` passes the string to a shell. 6. Shell metacharacters in the proxy value execute an attacker-selected command. ### Impact Assessment Exploitation results in arbitrary command execution with the privileges of the Skill process. The attacker may read or modify accessible files, retrieve process credentials, interfere with the browser session, or install further ...[truncated 75 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/playwright_search.ts:174- Finding
Chromium Sandbox and Same-Origin Security Are Explicitly Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/playwright_search.ts:86- Finding
Amazon Session Cookies Are Persisted in Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented purpose understates behaviors such as child-process execution, proxy configuration, image downloading, and cache deletion. This is dangerous because users and orchestrators may approve the skill based on an incomplete trust model, while the skill can perform broader filesystem and network actions than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented purpose understates behaviors such as child-process execution, proxy configuration, image downloading, and cache deletion. This is dangerous because users and orchestrators may approve the skill based on an incomplete trust model, while the skill can perform broader filesystem and network actions than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented purpose understates behaviors such as child-process execution, proxy configuration, image downloading, and cache deletion. This is dangerous because users and orchestrators may approve the skill based on an incomplete trust model, while the skill can perform broader filesystem and network actions than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose understates behaviors such as child-process execution, proxy configuration, image downloading, and cache deletion. This is dangerous because users and orchestrators may approve the skill based on an incomplete trust model, while the skill can perform broader filesystem and network actions than advertised.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented purpose understates behaviors such as child-process execution, proxy configuration, image downloading, and cache deletion. This is dangerous because users and orchestrators may approve the skill based on an incomplete trust model, while the skill can perform broader filesystem and network actions than advertised.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The command 'curl -fsSL https://bun.sh/install | bash' downloads a remote script and executes it immediately with shell privileges. This is a classic supply-chain risk: if the server, transport, or content is compromised, users execute arbitrary code without inspection.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping network-fetched content directly into 'bash' chains retrieval and execution into one step, removing any review checkpoint and amplifying the impact of a malicious or tampered response. In a skill setup guide, users are likely to copy-paste this verbatim, making exploitation practical.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Use the script at `scripts/amazon_search.ts`.
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file explicitly implements Amazon cookie harvesting through headless browser automation and pairs it with stealth features intended to avoid detection. That behavior materially exceeds a normal product-search skill and enables session-token collection that could be reused for unauthorized scraping or account/session abuse.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code contains multiple stealth mechanisms: disabling automation indicators, spoofing navigator properties, modifying permissions behavior, and simulating human activity. In a search-only skill, these are not operationally necessary and strongly suggest evasion of bot-detection controls, which increases the likelihood of misuse against a third-party service.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Printing harvested cookies directly to stdout exposes live session material to terminal history, CI logs, shell telemetry, and any adjacent process capturing output. Because cookies can function as bearer tokens, this creates an immediate risk of session hijacking or unauthorized reuse.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # Environment variables .env .env.local .env.*.local
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # Environment variables .env .env.local .env.*.local
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text # Environment variables .env .env.local .env.*.local # Node.js
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/amazon_search.ts:16
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/vendors/image-cache/src/index.ts:17