Amazon Asin Lookup Api Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 AM UTC
• Version: 0.1.4

Overview

The skill does what it claims, but it tells users to provide a BrowserAct API key through chat, which is an avoidable credential-exposure risk.

Review before installing. Configure BROWSERACT_API_KEY outside chat using a protected local environment or secret manager, and do not paste the key into the conversation. Expect ASIN lookups to be sent to BrowserAct's API; rotate the key if it has already been shared in chat.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: BrowserAct API Key Solicited Through Insecure Chat Channel< to get your Key." ``` `scripts/amazon_asin_lookup_api.py:102-106`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Set it as an environment variable (BROWSERACT_API_KEY) or provide it in the chat.", flush=True) ``` ### Technical Analysis The Skill explicitly directs the agent to ask the user for a BrowserAct API key and tells the user that the credential may be provided in chat. API keys are authentication secrets and should not be transmitted through conversational interfaces. A key entered into chat may become available to conversation history, application logs, model context, monitoring systems, third-party integrations, or other components that process agent messages. This exceeds the minimum privilege and data exposure necessary for the declared Amazon ASIN lookup functionality because the implementation already supports retrieving the credential from the `BROWSERACT_API_KEY` environment variable. The script sends the credential as a Bearer token only to the documented HTTPS BrowserAct endpoint. That network transmission is consistent with the declared functionality. The vulnerability is the unnecessary solicitation ...[truncated 1619 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every instruction suggesting that users provide API keys in chat. 2. Change `SKILL.md` so the agent stops execution and instructs the user to configure `BROWSERACT_API_KEY` outside the conversation. 3. Replace the vulnerable script message with wording such as: ```python print( "3. Configure BROWSERACT_API_KEY locally using a protected environment " "configuration or secret manager. Do not paste the key into chat.", flush=True, ) ``` 4. Prefer a platform-provided secret manager or encrypted credential store over persistent plaintext shell configuration. 5. Ensure that the key is never printed, included in exceptions, returned in results, or written to logs. 6. If interactive entry is required, use a masked local prompt such as `getpass.getpass()` and avoid retaining the value after the process exits. 7. Document key rotation and revocation procedures for users who previously disclosed a key in chat. 8. Apply the least privileges available to BrowserAct credentials and use separate keys for development and production environments. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

return None

if __name__ == "__main__":
    # Get API key from environment variable
    api_key = os.getenv("BROWSERACT_API_KEY")
    
    if len(sys.argv) < 2:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill requires access to an environment variable and performs network-backed API operations, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an overbroad execution model where an agent may invoke broader capabilities than are necessary, increasing the chance of unintended data access or outbound requests if the skill is misused or modified.

External Transmission

Medium

• Category: Data Exfiltration

Content

# API Configuration
# Amazon ASIN Lookup API Template ID
TEMPLATE_ID = "77814333389670716"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_amazon_asin_lookup(api_key, asin):
    """

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 1. Start Task
    print(f"Starting Amazon ASIN Lookup task for ASIN: {asin}", flush=True)
    try:
        response = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers)
        res = response.json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)

• Confidence: 87% confidence
• Finding: This code sends user-supplied ASIN data and a bearer token to an external third-party service, which is a real data egress boundary. In the context of an agent skill, external transmission is security-relevant because users may not expect their inputs or associated access credentials to be processed by BrowserAct, and there is no consent, validation, timeout, or host restriction logic beyond a hardcoded URL.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The file explicitly states it will 'Force UTF-8 encoding' for stdout and stderr, imposing a locale/encoding choice unconditionally. Although UTF-8 is generally reasonable, this is still a natural-language policy concern because the skill does not offer user choice or document why overriding the runtime's existing encoding is required.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The script reads a sensitive API key from the BROWSERACT_API_KEY environment variable and instructs the user that they may also provide it 'in the chat'. While the code does print setup guidance, it does not warn users about the sensitivity of the credential or discourage sharing it in less secure channels. This is a user-facing safety disclosure gap for credential handling in a code file.

Static analysis

No suspicious patterns detected.