Amazon Category Ungating

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.0

Overview

This skill openly provides browser automation through a local Ziniao bridge and does not show hidden, destructive, or unrelated behavior in the reviewed artifact.

Install only if you intentionally want an assistant to control Ziniao Browser stores through your local ZClaw bridge. Treat the ZCLAW_API_KEY and any logged-in store sessions as sensitive, and use extra care before allowing actions that click, type, download, or change account data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage trigger phrase is broad enough to match ordinary user requests about Amazon category ungating, which can cause the skill to auto-activate in contexts where the user did not explicitly intend to invoke this specific package. Overly broad activation increases the attack surface for prompt hijacking, unintended instruction injection, and accidental disclosure or action under the wrong skill context.

VirusTotal

58/58 vendors flagged this skill as clean.