Amazon Ppc Campaign

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:30 AM UTC
• Version: 0.1.0

Overview

The skill mostly fits Amazon PPC planning, but it needs Review because it combines automatic shell/web fetching, a mutable global installer, and loosely scoped recurring reminder guidance.

Review before installing. Use a pinned installer/source if possible, avoid global installation unless you want the skill available across sessions, and require the agent to ask before running the competitor-fetch script, making Amazon web requests, or creating any recurring reminder job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Performs a Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-15
Vulnerability Type: Supply-chain exposure through mutable, unpinned dependencies
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add nexscope-ai/Amazon-Skills --skill amazon-ppc -g

Technical Analysis

The documented installation command invokes an unpinned package through npx and installs skill content globally from a mutable GitHub repository reference. Neither the CLI version nor the repository commit is fixed to an immutable, reviewed version.

npx may download and execute package code during installation. If the package distribution account, dependency chain, or referenced repository is compromised, the effective code executed by this command can differ from the version reviewed in this audit. The global installation option also expands the scope of the resulting changes beyond the current project.

This is not a direct curl | bash instruction, and the audited project does not itself contain a confirmed malicious installation payload. The risk arises from executing mutable third-party installer code and globally installing mutable remote content.

Attack Path

1. An attacker compromises the npm package used by npx, one of its dependencies, the source repository, or a maintainer account.
2. The attacker publishes malicious installer code or modifies the skill content at the mutable repository reference.
3. A user follows the installation command in SKILL.md.
4. npx retrieves and executes the current package version with the user's privileges.
5. The installer retrieves the mutable repository content and installs it globally.
6. Malicious installation logic or skill instructions can modify user-accessible files, install persistent skill content, or execute other operations permitted to the invoking account.

Impact Assessment

Exploitation could provide code execution with the privileges of the user runnin ...[truncated 453 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills CLI to an explicitly reviewed version instead of allowing npx to resolve the latest release.
2. Pin the GitHub source to a verified immutable commit hash or signed release tag.
3. Publish and verify cryptographic checksums or signatures for the installed skill package.
4. Remove the global installation option by default and install into an isolated project or user-approved sandbox.
5. Use a lockfile or equivalent dependency manifest for all transitive dependencies.
6. Document the exact package provenance, expected files, and verification procedure.
7. Run installation with a minimally privileged account and prevent installer access to unrelated credentials and sensitive directories.
8. Consider distributing a reviewed local package rather than executing an installer that retrieves mutable content at installation time.

T06 · System Persistence

Note

• Location: SKILL.md:487

Finding

Optional Recurring Jobs Are Suggested Without Persistence Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:487
Vulnerability Type: Insufficiently controlled cross-session scheduling
Risk Level: Low

Complete Code Snippet:

text

After setup, offer weekly reminders (cron/heartbeat): search term analysis + bid adjustments + monthly full audit.

Technical Analysis

The skill suggests using cron or heartbeat mechanisms for ongoing management. Such mechanisms can survive the current interaction and cause actions to occur in later sessions. Recurring reminders are relevant to PPC monitoring, but persistence is not required for the core campaign-building and auditing functionality.

The instruction does not explicitly direct the agent to install a backdoor or create a scheduler entry automatically. However, it also does not require explicit informed consent, define the permitted schedule and command, restrict execution privileges, or provide inspection and removal procedures. An overly autonomous agent could interpret the recommendation as permission to create a persistent job.

No actual cron configuration, startup service, or persistent script was found in the audited project. This finding therefore concerns unsafe guidance and the possibility of unnecessary persistence rather than a confirmed installed scheduled task.

Attack Path

1. A user completes a PPC campaign setup or audit using the skill.
2. The skill offers ongoing reminders through cron or a heartbeat mechanism.
3. An agent interprets acceptance of reminders broadly and creates a recurring job without presenting the exact command, schedule, environment, and removal procedure.
4. The job continues to execute after the original session has ended.
5. If the scheduled command or referenced files are later modified, subsequent executions may perform unintended actions with the scheduler owner's privileges.

Impact Assessment

A created job would generally execute with the privileges of the acco ...[truncated 469 chars]

Remediation

View remediation

Remediation Suggestions

1. State explicitly that no recurring task may be created without separate, informed user approval.
2. Display the exact schedule, command, working directory, network behavior, and data accessed before requesting approval.
3. Default to non-persistent reminders managed by the host platform where possible.
4. If scheduling is approved, use the least-privileged user and a narrowly scoped command.
5. Avoid scheduled commands that retrieve or execute mutable remote code.
6. Record the scheduler entry created and provide commands to inspect, disable, and permanently remove it.
7. Require a defined expiration date or bounded execution count rather than creating an indefinite recurring task.
8. Ensure that declining reminders does not prevent use of the skill's core PPC functionality.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose presents the skill as a PPC planning/optimization assistant, but the instructions also direct it to scrape competitor listings and perform direct network fetches. That mismatch undermines informed consent and hides materially different behavior, making users less able to assess privacy, compliance, and execution risk.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The skill directs the agent to execute external network-fetching commands via shell (curl piped into python3) and to run a bundled fetch-competitor.sh script. Shell-driven retrieval of remote content expands the attack surface substantially: remote responses may be malformed, manipulated, or used to influence downstream parsing and decisions, and the script itself is opaque from this file's perspective.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

2. **From competitor ASINs**: User provides 1-3 competitor ASINs → run `scripts/fetch-competitor.sh <ASIN>` for each → extract keywords from their titles and bullet points. The script returns title, brand, bullets, price, category, BSR, and review count.
3. **From user's list**: User provides their own keywords (e.g., from Helium 10, search term reports, or manual research).

Additionally, expand keywords using Amazon autocomplete: `curl -s "https://completion.amazon.com/api/2017/suggestions?mid=ATVPDKIKX0DER&alias=aps&prefix=<URL-ENCODED-KEYWORD>" | python3 -c "import sys,json; [print(s['value']) for s in json.load(sys.stdin).get('suggestions',[])]"`

### Step A4: Build Campaign Structure and Group Keywords

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run shell commands and bundled scripts, but it declares no tool scope or allowed-tools restrictions. That creates an authorization gap where an agent may execute shell/network actions beyond what the user expects, increasing the chance of unintended data access or command execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The installation command uses npx skills without a pinned version, so users may install or execute whatever version is current at runtime. This is a supply-chain risk: a compromised or breaking upstream package could alter skill behavior, introduce malicious code, or expand capabilities unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section explicitly says 'Short Prompts Work Too' and includes examples like 'My ACoS is too high, help me fix it' and 'I want to start advertising on Amazon.' These phrases are broad natural language requests without clear invocation boundaries or exclusion conditions, which could cause unintended triggering in ordinary conversation about Amazon selling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description does not warn users that it may automatically run a bundled script and perform web lookups to gather product and competitor data. This lack of disclosure weakens informed consent and can lead to unexpected external requests, competitor-data collection, and shell execution in contexts where users expected only local analysis.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation claims the skill cannot access certain real-time data, while earlier sections instruct the agent to fetch live autocomplete and related web data. Conflicting statements can mislead users and reviewers about actual runtime behavior, causing unsafe trust decisions and reducing oversight of network-capable actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file adds competitor intelligence collection functionality that is only loosely related to the declared campaign builder/optimizer scope and is not clearly surfaced in the metadata. Hidden or weakly justified data-collection features increase the risk of misuse, compliance issues, and trust erosion because they expand the skill's behavior beyond what users reasonably expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs undisclosed live scraping of Amazon product pages using curl and parses competitor listing content for keyword extraction. This creates a transparency and governance risk: users may invoke a PPC optimization skill without realizing it reaches out to third-party sites and collects competitor intelligence, which can violate user expectations, platform policy, or terms of service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTTP request hard-codes an Accept-Language: en-US,en;q=0.9 header, which imposes a specific language/locale regardless of the selected marketplace or user preference. This is a natural-language locale policy issue because the script does not offer any user choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.