Tariff Calculator Amazon

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:30 AM UTC
• Version: 0.1.0

Overview

This skill appears non-malicious, but it overstates financial/compliance calculation capabilities and recommends a mutable global installer.

Review carefully before installing. Prefer running the reviewed Python scripts directly in an isolated folder, avoid the global unpinned npx install unless you trust the publisher and source at install time, and do not rely on the tariff outputs for customs or tax decisions without independently verifying current official rates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned npx Installer Introduces a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Unpinned third-party installer and mutable Skill source
Risk Level: Medium

Vulnerable Code

bash

npx skills add nexscope-ai/eCommerce-Skills --skill tariff-calculator-amazon -g

Technical Analysis

The documented installation command invokes npx without pinning the skills package to an exact, reviewed version. Depending on the local environment and package availability, npx can download and execute the current package published under that name.

The Skill source, nexscope-ai/eCommerce-Skills, is also referenced without an immutable commit identifier, release artifact checksum, or signature. Consequently, the code executed by the installer and the Skill content installed for the user can change after this project has been reviewed.

The -g option requests global installation, increasing the persistence and scope of any compromised content. The audited Python scripts do not require this external installation command for direct execution, so the additional supply-chain exposure is avoidable.

No evidence was found that the currently reviewed local scripts are malicious. The vulnerability concerns the mutable external components executed or installed by the documented command.

Attack Path

1. An attacker compromises the package registry account or publication pipeline for the unpinned skills package, or compromises the referenced Skill repository.
2. The attacker publishes a malicious package version or modifies the repository content while retaining the expected package or repository name.
3. A user follows the installation instructions and runs the documented npx skills add ... -g command.
4. npx resolves and retrieves the mutable external package, then executes its installer code with the privileges of the invoking user.
5. The compromised installer or repository content installs altered Skill files globally, and may perform any ot ...[truncated 708 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the skills package to an exact reviewed version, for example by using an explicit version instead of allowing npx to resolve the latest release.
2. Pin the Skill repository to an immutable commit hash or distribute a versioned release artifact with a published cryptographic checksum.
3. Verify package integrity, provenance, and publisher ownership before execution. Prefer signed artifacts where the package ecosystem supports them.
4. Remove the global installation option unless global installation is strictly necessary. Use a project-local or isolated environment to limit the effect of a compromised installer.
5. Avoid elevated execution and explicitly warn users not to run the installer with administrator or root privileges.
6. Document direct offline execution of the reviewed Python scripts as the preferred method when installation through an external package is unnecessary.
7. Add automated dependency provenance and integrity checks to the release process so that documented versions and checksums are updated only after review.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises a fully functional tariff calculator with route logic, VAT/GST, trade agreement handling, and landed-cost computation, but the analysis indicates the implementation does not actually perform those calculations and only exposes limited static metadata. This is dangerous because users may rely on inaccurate or nonexistent compliance calculations for import/export decisions, causing financial loss, customs errors, and regulatory exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This file includes bilingual output support, but the CLI behavior hardcodes English as default and switches to Chinese only when a specific internal flag is present. Because the language behavior is controlled by implementation rather than an explicit user-facing choice or prompt, it can violate language/locale policy expectations requiring opt-in or clear selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This skill contains bilingual natural-language output and a language-selection mechanism, but the default behavior and interface text do not clearly communicate language choice to the user. Under the locale-policy rule, forcing or implicitly preferring a language without clear opt-in can be a policy concern unless the choice is explicitly offered and documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.