Amazon Asin Lookup Api Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 AM UTC
• Version: 0.1.4

Overview

The skill does what it claims, but it tells users to provide a BrowserAct API key through chat, which is an avoidable credential-exposure risk.

Review before installing. Configure BROWSERACT_API_KEY outside chat using a protected local environment or secret manager, and do not paste the key into the conversation. Expect ASIN lookups to be sent to BrowserAct's API; rotate the key if it has already been shared in chat.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

BrowserAct API Key Solicited Through Insecure Chat Channel

Content

View full analysis

"Since you haven't configured the BrowserAct API Key, please visit the [BrowserAct Console](https://www.browseract.com/reception/integrations) to get your Key." ``` `scripts/amazon_asin_lookup_api.py:102-106`: ```python if not api_key: print("\n[!] ERROR: BrowserAct API Key is missing.", flush=True) print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Set it as an environment variable (BROWSERACT_API_KEY) or provide it in the chat.", flush=True) ``` ### Technical Analysis The Skill explicitly directs the agent to ask the user for a BrowserAct API key and tells the user that the credential may be provided in chat. API keys are authentication secrets and should not be transmitted through conversational interfaces. A key entered into chat may become available to conversation history, application logs, model context, monitoring systems, third-party integrations, or other components that process agent messages. This exceeds the minimum privilege and data exposure necessary for the declared Amazon ASIN lookup functionality because the implementation already supports retrieving the credential from the `BROWSERACT_API_KEY` environment variable. The script sends the credential as a Bearer token only to the documented HTTPS BrowserAct endpoint. That network transmission is consistent with the declared functionality. The vulnerability is the unnecessary solicitation ...[truncated 1619 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/amazon_asin_lookup_api.py (reported line 90)May include surrounding context.

python

return None

if __name__ == "__main__":
    # Get API key from environment variable
    api_key = os.getenv("BROWSERACT_API_KEY")
    
    if len(sys.argv) < 2:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires access to an environment variable and performs network-backed API operations, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an overbroad execution model where an agent may invoke broader capabilities than are necessary, increasing the chance of unintended data access or outbound requests if the skill is misused or modified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/amazon_asin_lookup_api.py (reported line 16)May include surrounding context.

python

# API Configuration
# Amazon ASIN Lookup API Template ID
TEMPLATE_ID = "77814333389670716"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_amazon_asin_lookup(api_key, asin):
    """

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This code sends user-supplied ASIN data and a bearer token to an external third-party service, which is a real data egress boundary. In the context of an agent skill, external transmission is security-relevant because users may not expect their inputs or associated access credentials to be processed by BrowserAct, and there is no consent, validation, timeout, or host restriction logic beyond a hardcoded URL.

Content

Scanner excerpt · scripts/amazon_asin_lookup_api.py (reported line 33)May include surrounding context.

python

# 1. Start Task
    print(f"Starting Amazon ASIN Lookup task for ASIN: {asin}", flush=True)
    try:
        response = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers)
        res = response.json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The file explicitly states it will 'Force UTF-8 encoding' for stdout and stderr, imposing a locale/encoding choice unconditionally. Although UTF-8 is generally reasonable, this is still a natural-language policy concern because the skill does not offer user choice or document why overriding the runtime's existing encoding is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The script reads a sensitive API key from the BROWSERACT_API_KEY environment variable and instructs the user that they may also provide it 'in the chat'. While the code does print setup guidance, it does not warn users about the sensitivity of the credential or discourage sharing it in less secure channels. This is a user-facing safety disclosure gap for credential handling in a code file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.