Amazon Listing Optimization

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:22 AM UTC
• Version: 0.1.0

Overview

This Amazon listing skill is purpose-aligned and disclosed, with ordinary caution needed because it fetches public Amazon pages and uses an unpinned global install command.

Install only from a source you trust, preferably with a pinned installer version or reviewed commit. Expect the skill to send ASINs and product-page requests to Amazon and possibly web search/fetch tools; do not use it for confidential launch plans unless that exposure is acceptable. Review generated listing copy before pasting it into Seller Central.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Package Execution and Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14
Vulnerability Type: Unpinned third-party dependency and mutable repository installation
Risk Level: Medium

Vulnerable Code

bash

npx skills add nexscope-ai/Amazon-Skills --skill amazon-listing-optimization -g

Technical Analysis

The documented installation command invokes npx without specifying an exact version of the skills package. Depending on the local environment and npm behavior, npx may download and execute the package version currently resolved by the registry.

The command also identifies the GitHub repository by its mutable owner/repository name rather than an immutable, reviewed commit hash. The -g option requests a global installation. Therefore, the code executed by npx and the Skill content installed from the repository can differ from the artifact reviewed during this audit.

This is a supply-chain weakness rather than evidence that the current package contains malicious code. Exploitation requires compromise or malicious modification of an upstream npm package, publishing account, repository, or resolved dependency.

Attack Path

1. An attacker compromises an upstream npm publishing account, the package-resolution path, or the referenced GitHub repository.
2. The attacker publishes or commits modified installer or Skill content under the same mutable package or repository identity.
3. A user follows the installation command from SKILL.md.
4. npx resolves and executes the unpinned package, which retrieves the repository's current content.
5. The malicious installer executes with the invoking user's privileges or installs altered Skill content globally.
6. The globally installed content can subsequently influence Skill invocations until it is detected and removed.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user running the installation command. The attacker could access files an ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm installer to an exact, reviewed version rather than relying on registry resolution:

   bash

   npx --yes skills@<exact-reviewed-version> add ...
   

2. Pin the Skill repository source to an immutable, reviewed commit hash or signed release artifact if the installer supports that syntax.

3. Verify package integrity through npm lockfile integrity metadata, checksums, provenance attestations, or signed release verification.

4. Prefer a project-local installation over -g unless global availability is necessary.

5. Document the exact expected package version, repository commit, and artifact checksum so users can verify what will be installed.

6. Run installation without administrator privileges and in a restricted environment where practical.

7. Establish an update process that reviews new versions before changing the pinned dependency or repository revision.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is described as a benign listing optimizer, but its documented behavior includes fetching live Amazon pages, competitor analysis, and script-based data retrieval that are not clearly surfaced as operational capabilities. This mismatch can mislead users and policy systems about what the skill actually does, causing unreviewed data access, unexpected network activity, or execution of tooling under false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell-based scripts such as fetch-listing.sh but does not declare any tool scope or allowed-tools boundary. This creates an authorization and transparency gap: an agent may invoke shell capabilities unexpectedly, increasing the risk of over-privileged execution or unsafe command use when handling user-supplied ASINs, URLs, or marketplace values.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The installation command uses npx skills without a pinned version, so users may execute whatever package version is current at install time. That creates a supply-chain risk where a malicious or compromised upstream release could change behavior, permissions, or fetched dependencies without notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill encourages users to submit competitor ASINs and URLs for analysis but does not warn that those identifiers may be sent to external web-fetch or script-based retrieval tools. This undermines informed consent and can expose user business intent, research targets, or private listing URLs to external systems without clear disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

A second unpinned npx skills reference repeats the same supply-chain exposure inside the workflow documentation. Repeated unpinned commands increase the chance that users copy and run non-reproducible installation steps that may resolve to unsafe upstream code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction mandates that the entire output must be in the marketplace language regardless of the language used by the user in the conversation. This is a natural-language locale policy issue because it imposes a language choice without user opt-in or an alternative.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a tool for creating and optimizing Amazon listings, with competitor comparison mentioned at a high level, but it does not state that this component retrieves raw product-page HTML directly from Amazon. This file performs outbound HTTP requests to Amazon domains to scrape listing data, which is a materially different operational behavior than pure copy generation or keyword/listing analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script hard-codes Accept-Language: en-US,en;q=0.9, which imposes a specific language/locale on every request. This matches a natural-language policy concern because users are not given any opt-in or override for locale, and the file does not justify why English-only output is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.