Amazon Subscribe & Save

• Outcome: Pass
• Latest audit: May 29, 2026, 8:37 PM
• Version:
  1.0.0

Overview

This skill provides Amazon Subscribe & Save business advice and does not contain code, credential requests, persistence, or automatic account-changing behavior.

Reasonable to install for Subscribe & Save optimization advice. Share only the business and product details needed for analysis, avoid providing Amazon passwords, session cookies, or unnecessary confidential account data, and review any recommendations before making seller account changes yourself.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage example is a very broad natural-language trigger phrase that closely matches ordinary user requests about Amazon Subscribe & Save. In systems that auto-route or auto-activate skills based on conversational similarity, this can cause the skill to fire unintentionally, expanding the skill's reach beyond deliberate invocation and potentially exposing users to unwanted guidance or data collection flows.

VirusTotal

66/66 vendors flagged this skill as clean.