eBay Account Automation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This skill openly automates eBay account activity, but it can change marketplace state across multiple browser profiles on a schedule with weak guardrails.

Install only if you intentionally want scheduled automation that controls ADS Power browser profiles and changes eBay account state. Use a dedicated ADS Power group or account allowlist, avoid running it against accounts you do not own or are not authorized to operate, review eBay/platform rules first, secure the ADS_API_KEY outside source control, pin dependencies with a lockfile, and fix diagnostic cleanup before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:11

Finding

Non-Reproducible Dependency Installation Due to Unpinned Versions and Missing Lockfile

Content

View full analysis

Vulnerability Details

File Location: scripts/package.json:11-13; installation instruction at SKILL.md:43-48
Vulnerability Type: Supply-chain risk from mutable dependency resolution
Risk Level: Medium

Vulnerable Code

scripts/package.json:11-13:

json

"dependencies": {
  "axios": "^1.7.0",
  "ws": "^8.18.0"
}

SKILL.md:43-48:

bash

cd skills/ebay-account-automation/scripts
npm install

Technical Analysis

The project declares dependencies with caret version ranges and does not include a reviewed package-lock.json. The documented npm install command therefore resolves dependency versions at installation time rather than installing a fixed, reproducible dependency graph.

The caret constraints permit newer compatible releases. This means two users installing the same audited project at different times may receive different direct or transitive package code. npm packages may also define lifecycle scripts that execute during installation with the privileges of the user running npm.

No currently malicious package was identified in the supplied files. The vulnerability is the absence of dependency integrity controls, which creates a supply-chain attack opportunity after the project itself has been reviewed.

Attack Path

1. An attacker compromises a permitted future release of axios, ws, or one of their transitive dependencies.
2. The attacker publishes malicious code within a version accepted by the caret range.
3. A user follows the documented npm install instruction.
4. npm resolves the compromised mutable version because no lockfile fixes the reviewed dependency graph.
5. Malicious lifecycle or runtime code executes under the user's account.
6. At runtime, that code may access the ADS Power API key, interact with ADS Power, or manipulate authenticated browser sessions available to the Node.js process.

Impact Assessment

Successful exploitation ...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin direct dependencies to exact reviewed versions rather than caret ranges:

   json

   "dependencies": {
     "axios": "1.7.0",
     "ws": "8.18.0"
   }
   

2. Generate and commit a package-lock.json after reviewing the complete dependency tree.

3. Replace the documented npm install command with npm ci so installation fails if package metadata differs from the lockfile.

4. Review package integrity hashes and dependency lifecycle scripts before release.

5. Use automated dependency scanning and update dependencies through reviewed pull requests.

6. Where practical, install with lifecycle scripts disabled during verification:

   bash

   npm ci --ignore-scripts
   

   Only enable scripts when a reviewed dependency demonstrably requires them.

7. Run the Skill under a dedicated, least-privileged operating-system account with access only to the required ADS Power instance and project directories.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/diag_selectors2.js:19

Finding

Diagnostic Errors Can Leave an Authenticated ADS Power Browser and Debug Session Running

Content

View full analysis

Vulnerability Details

File Location: scripts/diag_selectors2.js:19-147
Vulnerability Type: Missing guaranteed cleanup for privileged browser resources
Risk Level: Medium

Vulnerable Code

The diagnostic utility starts an authenticated ADS Power browser before performing multiple operations that may throw:

javascript

const userId = process.argv[2];

console.log('正在启动浏览器...');
const browserData = await ads.startBrowser(userId);
const debugPort = browserData.debug_port;
console.log(`debug_port: ${debugPort}`);

// 连接 browser WS
const browserWs = await new Promise((resolve, reject) => {
  const ws = new WebSocket(browserData.ws?.puppeteer);
  ws.on('open', () => resolve(ws));
  ws.on('error', reject);
});

Cleanup is performed only at the end of the successful execution path:

javascript

console.log('\n诊断完成，正在关闭浏览器...');
pageWs.close();
browserWs.close();
await ads.stopBrowser(userId);
}

main().catch(e => { console.error(e); process.exit(1); });

Technical Analysis

The browser stop operation is not protected by a finally block. Once ads.startBrowser(userId) succeeds, any later exception can bypass all cleanup.

Failure points include:

• Failure to establish either WebSocket connection.
• Failure to find the newly created page target.
• A CDP command timeout.
• Navigation failure.
• Selector evaluation failure.
• An exception while processing a browser response.

The top-level rejection handler immediately exits the process without calling ads.stopBrowser(userId). Closing the Node.js process may close its own WebSocket handles, but it does not guarantee that ADS Power stops the underlying browser profile or disables its debugging endpoint.

This issue is specifically present in the diagnostic utility. The normal account runner uses a finally block and therefore has stronger cleanup behavior.

Attack Path

1. A user invokes `node diag_ ...[truncated 1691 chars]

Remediation

View remediation

Remediation Suggestions

1. Track browser and WebSocket resources from the moment startup succeeds.
2. Put all subsequent diagnostic operations inside try/finally.
3. In the finally block:
   • Close pageWs if it was created.
   • Close browserWs if it was created.
   • Always call ads.stopBrowser(userId) after successful browser startup.
   • Log cleanup failures without skipping the remaining cleanup operations.
4. Add SIGINT and SIGTERM handlers so interruption also stops the profile.
5. Avoid calling process.exit() until asynchronous cleanup has completed.
6. Use an idempotent cleanup function to prevent duplicate-stop errors.

Recommended structure:

javascript

async function main() {
  const userId = process.argv[2];
  let browserStarted = false;
  let browserWs = null;
  let pageWs = null;

  try {
    const browserData = await ads.startBrowser(userId);
    browserStarted = true;

    // Establish WebSocket connections and perform diagnostics.
  } finally {
    if (pageWs) {
      try { pageWs.close(); } catch (e) {
        console.warn(`Failed to close page WebSocket: ${e.message}`);
      }
    }

    if (browserWs) {
      try { browserWs.close(); } catch (e) {
        console.warn(`Failed to close browser WebSocket: ${e.message}`);
      }
    }

    if (browserStarted) {
      try { await ads.stopBrowser(userId); } catch (e) {
        console.warn(`Failed to stop ADS browser: ${e.message}`);
      }
    }
  }
}

Use a graceful top-level handler that sets a nonzero exit code rather than exiting before cleanup:

javascript

main().catch(e => {
  console.error(e);
  process.exitCode = 1;
});

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code does not implement eBay seller activity automation. Instead, it is an ADS Power API utility module for managing browser profiles and querying account metadata. While ADS Power is mentioned in the description, the primary behavior here is infrastructure/control-plane functionality, not the declared end-user actions. The code lists users/groups, starts and stops browsers, checks active sessions, and gets profile info, which are undeclared capabilities relative to the stated purpose. Conversely, the described search/browse/favorite/cart cycle logic and scheduling behavior are absent from this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description describes a full automation workflow for eBay activity cycles via ADS Power. However, the supplied code does not implement those actions. It only provides helper functions for timing randomness and loading keywords from disk. While these utilities could support such a system, this chunk by itself does not match the declared primary purpose and includes local file access not reflected in the description. Therefore, the description is not an accurate representation of what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill runs eBay seller account activity cycles through ADS Power, implying behavioral automation such as searching, browsing, favoriting, and carting on a schedule. The supplied code instead serves as a diagnostic script: it starts a browser, connects to Chrome DevTools/WebSocket endpoints, opens one hardcoded eBay product page, and evaluates whether specific selectors exist. It prints hit/miss results for watch buttons, cart buttons, search boxes, and item links, then exits. There is no rotating schedule, no account-cycle logic, no search/browse flow, and no actual favorite/cart interaction. This is a materially different primary purpose, so it is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes an automation skill for eBay seller activity cycles, but this code chunk does not implement any such behavior. It is solely a run logger that writes operational messages to local files and console output. While logging can be a supporting detail, the chunk’s actual behavior is materially different from the declared primary purpose because none of the advertised automation capabilities are present in the supplied code.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill automates state-changing marketplace actions such as favoriting and adding items to carts across rotating accounts, yet provides no prominent warning that it modifies third-party platform state and may violate platform rules. In this context, the missing warning is dangerous because the skill is explicitly designed for repeated simulated buyer activity, which can facilitate engagement manipulation and account abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code intentionally automates user-account actions on eBay, including adding items to cart and watchlist, without any interactive confirmation, visibility, or policy guardrails. In the context of a seller-account automation skill, these actions can manipulate marketplace engagement signals, create unauthorized account activity, and expose the account owner to fraud, trust-and-safety enforcement, or financial/reputational harm.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares allowed-tools: [] while instructing use of local configuration, filesystem state, environment-dependent execution, and browser/API automation. This mismatch can bypass operator expectations and security review boundaries, because the documented behavior requires capabilities beyond the declared scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is user-invocable and describes broad automated account activity without precise trigger constraints, target-account restrictions, or operator confirmation requirements. In context, this enables easy misuse for repetitive marketplace manipulation, account farming, or unauthorized actions across multiple profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly promotes automated simulation of user activity across multiple eBay seller accounts, including search, browsing, favoriting, and add-to-cart actions to keep accounts 'active.' In context, this is not just missing documentation hygiene: it describes coordinated engagement manipulation and browser automation against a third-party platform, which can violate platform rules, trigger account sanctions, and be repurposed for deceptive marketplace activity at scale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-facing comments and runtime log messages are written in Chinese throughout the file, indicating a fixed language/locale experience. There is no visible opt-in, language selection mechanism, or documented justification that this skill is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file emits multiple console messages and logs in Chinese, indicating the skill is effectively fixed to a single language. Under the language/locale policy, hard-coding one language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code appends runtime messages to a daily log file and rewrites that file for rotation, which is a file-write operation covered by the warning requirement for code files. Although write failures are warned about, there is no prior user-facing notice, confirmation, or explanatory comment/docstring disclosing that account-related activity and errors will be persisted under a local logs directory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script formats its user-facing output with a hardcoded 'zh-CN' locale and 'Asia/Shanghai' timezone. This is a natural-language/locale policy issue because it imposes a specific locale on all users without offering opt-in, fallback behavior, or documenting why the constraint is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to use keywords with 'English preferred' introduces a language preference in natural-language guidance without offering the user a choice or documenting a justified locale restriction. This is a language/locale policy issue under the natural-language policy category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The prominent descriptive text is in Chinese while the rest of the README is largely English, and there is no indication that the language choice is optional or region-specific. Per SQP-3, forcing or implicitly assuming a specific language without opt-in can be a language/locale policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README instructs users to place an ADS Power API key in a local config file or environment variable but gives no guidance on secret handling, storage, rotation, or exclusion from source control. Because this skill automates access to multiple browser profiles/accounts, compromise of that credential could grant broad control over managed sessions and associated account operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file contains a Chinese-only natural-language comment ("行为模拟引擎"). Under the policy, language constraints or forced locale-specific content should be flagged when the skill does not offer language choice or document a justified regional scope. No surrounding text indicates that Chinese is required or optional for users or maintainers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Comments and user-facing console messages such as the description and usage output are written only in Chinese. This imposes a fixed language on users without opt-in or justification, which matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code starts a browser session and connects to its debugging interfaces via WebSocket and local HTTP, which are network operations. Although the script logs progress, it does not clearly disclose to the user that it will expose and use browser debugging endpoints, a behavior that can affect privacy or system state.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency uses a caret range, which allows automatic installation of newer minor/patch releases instead of a single audited version. In an automation skill that drives browser activity and likely handles account sessions, this weakens supply-chain control and can introduce vulnerable or malicious upstream changes without explicit review.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json

"diag": "node diag_selectors2.js"
  },
  "dependencies": {
    "axios": "^1.7.0",
    "ws": "^8.18.0"
  },
  "engines": {

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Axios has multiple known advisories, and because the manifest does not pin an exact version, the actual installed release cannot be verified from this file alone. In a networked automation skill, an affected axios version could expose the agent to SSRF, credential leakage, or man-in-the-middle style abuse depending on how HTTP requests are used elsewhere in the project.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The ws dependency is specified with a caret range, so the installed version may vary over time and across environments. For a browser/CDP automation tool that relies on WebSocket communication, this creates avoidable supply-chain risk and makes it harder to verify whether the runtime version is safe.

Content

Scanner excerpt · scripts/package.json (reported line 13)May include surrounding context.

json

},
  "dependencies": {
    "axios": "^1.7.0",
    "ws": "^8.18.0"
  },
  "engines": {
    "node": ">=18"

Unverifiable Dependency: ws has 7 known advisory(ies) (CVE-2016-10518 (Remote Memory Disclosure in ws); CVE-2024-37890 (ws affected by a DoS when handling a request with many HTTP headers); CVE-2026-45736 (ws: Uninitialized memory disclosure) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The ws package has known security advisories, and the unpinned manifest means the deployed version is not provably safe from the package file alone. Given this skill's stated use of ADS Power/CDP browser automation, flaws in WebSocket handling could affect session integrity, enable denial of service, or expose sensitive browser automation traffic if a vulnerable version is present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file's human-facing comment and all emitted log messages are written in Chinese, which imposes a specific language choice in the skill's natural-language output. There is no indication that users can select another language or that the locale restriction is documented as intentional and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The startup logs explicitly format time using the zh-CN locale and present all user-facing output in Chinese. This imposes a specific language/locale choice without any visible opt-in or justification in the file, which matches the policy category for language or locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/config.js:15