Amazon Vine Program

• Outcome: Pass
• Latest audit: May 29, 2026, 8:37 PM
• Version:
  1.0.0

Overview

This is a simple Amazon Vine advice skill with no code, credential requests, persistence, or hidden account access.

Safe to install as written. Use it as business guidance, verify recommendations against current Amazon Vine policies, and avoid sharing Amazon credentials or sensitive seller exports unless you explicitly intend the agent to use that information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The usage trigger phrase is very broad and matches ordinary language about getting help with the Amazon Vine program for an e-commerce business. In systems that auto-invoke skills based on user phrasing, this can cause unintended activation, routing users into this skill when they were asking a general question, which may override user intent or expose more context than necessary to the skill.

VirusTotal

64/64 vendors flagged this skill as clean.