Security audit

Amazon Orders

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but it asks users to install an unpinned unofficial package that handles Amazon credentials and can export sensitive order history to plaintext files.

Review carefully before installing. Use a virtual environment, avoid sudo, consider pinning and verifying the amazon-orders package, expose Amazon credentials only to the command that needs them, and store any exported order files in a private protected location with restrictive permissions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:16
Finding: Unpinned Installation of an Unofficial Third-Party Package
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Unpinned and automatically upgraded third-party dependency
Risk Level: High

Vulnerable Code:

bash
### Install / upgrade ```bash python3 -m pip install --upgrade amazon-orders

text
### Technical Analysis The setup instructions install the latest available version of the unofficial `amazon-orders` package without specifying an audited version or verifying a cryptographic hash. The `--upgrade` option further ensures that a later, potentially unreviewed release replaces an existing installation. Because Python packages may execute code during installation and subsequently operate in a process containing `AMAZON_USERNAME`, `AMAZON_PASSWORD`, and potentially `AMAZON_OTP_SECRET_KEY`, compromise of the package registry account, maintainer infrastructure, or a future release could expose highly sensitive authentication material. The audited Skill does not itself contain evidence that the current package is malicious; the vulnerability is the absence of dependency integrity and version controls. ### Attack Path 1. An attacker compromises the package maintainer, publishing credentials, or package distribution channel. 2. The attacker publishes a malicious release under the legitimate `amazon-orders` package name. 3. A user follows the documented command with `--upgrade`. 4. `pip` retrieves and installs the attacker's latest package because no version or hash is enforced. 5. Malicious installation or runtime code executes with the invoking user's privileges. 6. The package reads Amazon credentials and the TOTP secret from the environment, accesses local files available to that user, or transmits order information to an attacker-controlled service. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `pip` or the CLI. It could compromise the user's Amazon use ...[truncated 287 chars]
Remediation: View remediation
Remediation Suggestions

Pin amazon-orders to a specifically reviewed version instead of using an unconstrained upgrade:
bash
python3 -m pip install "amazon-orders==<reviewed-version>"

Generate and enforce cryptographic hashes through a locked requirements file:
bash
python3 -m pip install --require-hashes -r requirements.txt

Review package source, transitive dependencies, release provenance, and published artifacts before updating the pinned version.

Install the package in a dedicated virtual environment under a non-privileged account.

Avoid invoking pip with sudo or administrative privileges.

Expose Amazon credentials only to the specific process that requires them and remove them from the environment immediately afterward.

Prefer short-lived authentication mechanisms where supported and monitor the Amazon account for unexpected sessions or activity.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:85
Finding: Sensitive Amazon Order Data Exported Without Restrictive File Permissions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 85–88
Vulnerability Type: Plaintext sensitive-data export with permissions inherited from the process umask
Risk Level: Medium

Vulnerable Code:

bash
### Export yearly history to JSON ```bash amazon-orders history --year 2023 --full-details > orders_2023.json

text
### Technical Analysis The documented command redirects full Amazon order details into a plaintext JSON file. Shell redirection creates the file using permissions determined by the current process umask. On systems with permissive defaults, the resulting file may be readable by other local users or services. The instructions do not establish a private destination, verify permissions, encrypt the output, or define secure retention and deletion practices. The `--full-details` option increases the sensitivity of the exported information. Depending on the package output, the file can contain order numbers, purchase history, prices, and other personal order metadata. No evidence establishes that the export includes payment credentials; the confirmed exposure is limited to the detailed order information produced by the command. ### Attack Path 1. A user runs the documented export command in a shared or insufficiently protected directory. 2. The shell creates `orders_2023.json` using the user's current umask. 3. A permissive umask or directory policy makes the file readable by another local account, service, backup process, synchronization client, or unintended application. 4. The unauthorized party copies or processes the plaintext order history. 5. The disclosed data may be used for privacy invasion, profiling, targeted phishing, or social-engineering attacks involving genuine purchases and order numbers. ### Impact Assessment Exploitation does not directly grant elevated system privileges. It can disclose sensitive personal purchase information within the scope of the exported ...[truncated 241 chars]
Remediation: View remediation
Remediation Suggestions

Set a restrictive umask before creating the export:
bash
umask 077 amazon-orders history --year 2023 --full-details > orders_2023.json

Store exports in a private directory owned by the user and verify permissions after creation:
bash
chmod 600 orders_2023.json

Avoid shared, world-readable, automatically synchronized, or publicly backed-up directories.

Encrypt exports at rest when they must be retained.

Export only the fields and date range required for the task rather than using --full-details by default.

Document a retention period and securely delete the file when it is no longer needed.

Ensure backup, indexing, logging, and synchronization services do not ingest the file without explicit authorization.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill encourages exporting Amazon order history to a local JSON file but does not warn that the output may contain sensitive personal and financial-adjacent data such as purchase history, order numbers, addresses, and item details. In the context of an e-commerce order-history tool, omission of handling guidance increases the likelihood that users store this data insecurely, expose it through backups or source control, or leave it readable by other local users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.