Security audit

Amz Hot Keywords

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for AMZ123 keyword scraping, but its unsafe browser setting and CSV export handling make it worth manual review before use.

Install only in an isolated virtual environment or container, avoid running the browser as a privileged user, remove the default --no-sandbox setting unless your container explicitly requires it, and prefer JSON output or sanitize CSV cells before opening reports in spreadsheet software.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/amz_scraper.py:91
Finding: Spreadsheet Formula Injection Through Scraped Search Terms
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/amz_scraper.py:48
Finding: Chrome Sandbox Disabled While Processing Remote Web Content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/workflow.md:1
Finding: Unpinned and Unnecessary Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: pandas== \ --hash=sha256: ``` Hashes must be generated from the exact reviewed distributions rather than copied from an untrusted source. ]]>

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest uses very broad trigger phrases such as 'Amazon keyword', 'keyword trend', and multilingual variants without clear narrowing conditions. This can cause the skill to activate for loosely related requests and initiate web scraping or file-producing behavior when the user did not specifically ask for this tool, increasing the chance of unintended external access and unnecessary data collection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest frames this skill as scraping and returning structured keyword trend data from AMZ123. However, the workflow documentation adds an authentication capability via python-dotenv and credential handling if data becomes gated, which is not justified by the stated read-only public-scraping purpose and expands the skill into secret management/login automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill states that results are automatically written to local CSV/JSON files but does not warn the user that disk artifacts will be created. In an agent environment, silent file creation can surprise users, expose scraped data to other local processes or users, and leave residual files containing potentially sensitive or proprietary query results.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file opens by describing the skill as an end-to-end scraper for AMZ123 hot keyword rankings, consistent with the manifest. But the procedure then says it accepts a --keyword, submits a search, and scrapes a table of related search terms, which contradicts the claimed fixed-scope weekly hot-keyword ranking workflow and suggests materially different behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This markdown file documents that the skill writes scraped results to a timestamped CSV or JSON file and prints the absolute path, but it does not include any warning that running the skill will create files on the local filesystem. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or system state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.