Amazon Orders

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:01 PM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned, but it asks users to install an unpinned unofficial package that handles Amazon credentials and can export sensitive order history to plaintext files.

Review carefully before installing. Use a virtual environment, avoid sudo, consider pinning and verifying the amazon-orders package, expose Amazon credentials only to the command that needs them, and store any exported order files in a private protected location with restrictive permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16
• Finding: Unpinned Installation of an Unofficial Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, lines 16–18 **Vulnerability Type**: Unpinned and automatically upgraded third-party dependency **Risk Level**: High **Vulnerable Code:** ```bash ### Install / upgrade ```bash python3 -m pip install --upgrade amazon-orders ``` ``` ### Technical Analysis The setup instructions install the latest available version of the unofficial `amazon-orders` package without specifying an audited version or verifying a cryptographic hash. The `--upgrade` option further ensures that a later, potentially unreviewed release replaces an existing installation. Because Python packages may execute code during installation and subsequently operate in a process containing `AMAZON_USERNAME`, `AMAZON_PASSWORD`, and potentially `AMAZON_OTP_SECRET_KEY`, compromise of the package registry account, maintainer infrastructure, or a future release could expose highly sensitive authentication material. The audited Skill does not itself contain evidence that the current package is malicious; the vulnerability is the absence of dependency integrity and version controls. ### Attack Path 1. An attacker compromises the package maintainer, publishing credentials, or package distribution channel. 2. The attacker publishes a malicious release under the legitimate `amazon-orders` package name. 3. A user follows the documented command with `--upgrade`. 4. `pip` retrieves and installs the attacker's latest package because no version or hash is enforced. 5. Malicious installation or runtime code executes with the invoking user's privileges. 6. The package reads Amazon credentials and the TOTP secret from the environment, accesses local files available to that user, or transmits order information to an attacker-controlled service. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `pip` or the CLI. It could compromise the user's Amazon use ...[truncated 287 chars]
• Remediation: ## Remediation Suggestions - Pin `amazon-orders` to a specifically reviewed version instead of using an unconstrained upgrade: ```bash python3 -m pip install "amazon-orders==<reviewed-version>" ``` - Generate and enforce cryptographic hashes through a locked requirements file: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Review package source, transitive dependencies, release provenance, and published artifacts before updating the pinned version. - Install the package in a dedicated virtual environment under a non-privileged account. - Avoid invoking `pip` with `sudo` or administrative privileges. - Expose Amazon credentials only to the specific process that requires them and remove them from the environment immediately afterward. - Prefer short-lived authentication mechanisms where supported and monitor the Amazon account for unexpected sessions or activity.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:85
• Finding: Sensitive Amazon Order Data Exported Without Restrictive File Permissions## Vulnerability Details **File Location**: `SKILL.md`, lines 85–88 **Vulnerability Type**: Plaintext sensitive-data export with permissions inherited from the process umask **Risk Level**: Medium **Vulnerable Code:** ```bash ### Export yearly history to JSON ```bash amazon-orders history --year 2023 --full-details > orders_2023.json ``` ``` ### Technical Analysis The documented command redirects full Amazon order details into a plaintext JSON file. Shell redirection creates the file using permissions determined by the current process umask. On systems with permissive defaults, the resulting file may be readable by other local users or services. The instructions do not establish a private destination, verify permissions, encrypt the output, or define secure retention and deletion practices. The `--full-details` option increases the sensitivity of the exported information. Depending on the package output, the file can contain order numbers, purchase history, prices, and other personal order metadata. No evidence establishes that the export includes payment credentials; the confirmed exposure is limited to the detailed order information produced by the command. ### Attack Path 1. A user runs the documented export command in a shared or insufficiently protected directory. 2. The shell creates `orders_2023.json` using the user's current umask. 3. A permissive umask or directory policy makes the file readable by another local account, service, backup process, synchronization client, or unintended application. 4. The unauthorized party copies or processes the plaintext order history. 5. The disclosed data may be used for privacy invasion, profiling, targeted phishing, or social-engineering attacks involving genuine purchases and order numbers. ### Impact Assessment Exploitation does not directly grant elevated system privileges. It can disclose sensitive personal purchase information within the scope of the exported ...[truncated 241 chars]
• Remediation: ## Remediation Suggestions - Set a restrictive umask before creating the export: ```bash umask 077 amazon-orders history --year 2023 --full-details > orders_2023.json ``` - Store exports in a private directory owned by the user and verify permissions after creation: ```bash chmod 600 orders_2023.json ``` - Avoid shared, world-readable, automatically synchronized, or publicly backed-up directories. - Encrypt exports at rest when they must be retained. - Export only the fields and date range required for the task rather than using `--full-details` by default. - Document a retention period and securely delete the file when it is no longer needed. - Ensure backup, indexing, logging, and synchronization services do not ingest the file without explicit authorization.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill encourages exporting Amazon order history to a local JSON file but does not warn that the output may contain sensitive personal and financial-adjacent data such as purchase history, order numbers, addresses, and item details. In the context of an e-commerce order-history tool, omission of handling guidance increases the likelihood that users store this data insecurely, expose it through backups or source control, or leave it readable by other local users.

Static analysis

No suspicious patterns detected.