Amazon Product Bundling

• Outcome: Pass
• Latest audit: May 29, 2026, 8:37 PM
• Version:
  1.0.0

Overview

This skill only provides Amazon product-bundling advice and does not request credentials, local files, execution, persistence, or account authority.

Safe to install for general e-commerce advice. Avoid sharing confidential supplier terms, revenue details, or Amazon account credentials unless you intentionally want those details used in the recommendation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage example is a very broad natural-language phrase that closely matches ordinary user requests, which increases the chance of unintended invocation in unrelated conversations about Amazon or e-commerce. In an agent ecosystem where skills may auto-trigger from prompt similarity, this can cause overbroad activation, context hijacking, or the injection of skill-specific instructions when the user did not explicitly intend to use this skill.

VirusTotal

62/62 vendors flagged this skill as clean.