Amazon Product Fetcher

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but its marketplace setting can make network requests to arbitrary HTTPS hosts instead of being limited to Amazon.

Review this skill before installing in environments with access to internal services. It is appropriate for simple Amazon lookups, but the marketplace option should ideally be restricted to known Amazon domains and redirects should be constrained before use in sensitive networks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch.py:22

Finding

Unrestricted Marketplace Host Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch.py, lines 22 and 58–68; user-controlled assignment at lines 196–199
Vulnerability Type: Server-Side Request Forgery through an unrestricted network destination
Risk Level: Medium

Vulnerable Code

python

MARKETPLACE = os.environ.get("AMAZON_MARKETPLACE", "www.amazon.com")

python

def build_url(asin: str) -> str:
    return f"https://{MARKETPLACE}/dp/{asin}"

python

def fetch_page(url: str) -> str:
    req = urllib.request.Request(url, headers=HEADERS)
    try:
        with urllib.request.urlopen(req, timeout=15) as resp:
            charset = resp.headers.get_content_charset() or "utf-8"
            return resp.read().decode(charset, errors="replace")
    except Exception as e:
        print(f"Error fetching page: {e}", file=sys.stderr)
        sys.exit(1)

python

if args.marketplace:
    global MARKETPLACE
    MARKETPLACE = args.marketplace

Technical Analysis

The --marketplace argument and AMAZON_MARKETPLACE environment variable are accepted without validation and interpolated directly into the request URL. Although the scheme is fixed to HTTPS, an attacker who can control invocation arguments or the process environment can select an arbitrary hostname and port.

urllib.request.urlopen also follows HTTP redirects by default. Consequently, even a destination that initially appears acceptable could redirect the request to another host unless redirect targets are independently validated.

This behavior exceeds the minimum privileges required by the declared functionality. Fetching Amazon product data only requires access to supported Amazon marketplace domains; arbitrary network destinations are unnecessary. No evidence was found that credentials, cookies, authorization headers, environment dumps, or local-file contents are transmitted. The pre-scan concern is therefore best characterized as destination-control risk rather than confirmed sensitive-dat ...[truncated 1884 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace arbitrary marketplace configuration with an explicit allowlist of supported Amazon domains:

   python

   ALLOWED_MARKETPLACES = {
       "www.amazon.com",
       "www.amazon.co.uk",
       "www.amazon.de",
       "www.amazon.fr",
       "www.amazon.it",
       "www.amazon.es",
       "www.amazon.ca",
       "www.amazon.co.jp",
   }
   
   def validate_marketplace(value: str) -> str:
       host = value.strip().lower().rstrip(".")
       if host not in ALLOWED_MARKETPLACES:
           raise ValueError("Unsupported Amazon marketplace")
       return host
   

2. Reject marketplace values containing credentials, paths, query strings, fragments, custom ports, or schemes. Parse configuration as a hostname rather than concatenating an arbitrary string into a URL.

3. Reject IP literals and hostnames resolving to loopback, private, link-local, multicast, reserved, or unspecified address ranges. Perform this check for every resolved address and account for both IPv4 and IPv6.

4. Disable automatic redirects or validate every redirect destination against the same marketplace allowlist and address-range policy.

5. Validate ASIN input before constructing the URL:

   python

   if not re.fullmatch(r"[A-Z0-9]{10}", asin):
       raise ValueError("Invalid ASIN")
   

6. Prefer a fixed mapping from marketplace identifiers such as us, uk, or de to trusted Amazon hostnames instead of accepting raw hostnames.

7. Add tests confirming rejection of localhost, private addresses, IP literals, embedded credentials, custom ports, malformed hostnames, and redirects to non-allowlisted destinations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation indicates network-capable behavior and likely execution of local Python code, but it does not declare any explicit tool scope, permissions, or allowed-tools constraints. This creates an authorization and review gap: a host system may permit broader execution than intended, making it harder to enforce least privilege or detect misuse of network and environment access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file presents core usage and behavior descriptions in Chinese, which imposes a specific language on users without any opt-in or alternative language guidance. The policy calls for flagging language or locale constraints unless the skill explicitly offers a choice or clearly justifies the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The request headers force Accept-Language: en-US,en;q=0.9, which imposes a specific language/locale preference regardless of the user's actual locale. This is a natural-language policy concern because the file does not offer a language choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.