Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed AstrMap API client for Amazon review analysis, with expected external API and browser-extension dependencies but no hidden persistence or destructive local behavior in the inspected artifacts.
Install only if you trust AstrMap with the API key, product/task data, and review data involved. Use a dedicated Amazon buyer account for the browser extension, review the extension permissions in Chrome before loading it, and avoid using a seller or primary account. Consider pinning requests before deployment.
The skill documents use of environment variables and outbound network access but does not declare any explicit tool scope or allowed-tools constraints. That creates a permissions-transparency gap: an agent or reviewer cannot easily verify what capabilities the skill is expected to use, increasing the chance of over-broad execution or silent data egress.
The language policy states that replies must be in English whenever the user input is English or any non-Chinese language, making English a forced default for many users. This is a natural-language policy concern because it does not offer a user choice or opt-in for language/locale behavior.
The error-handling contract instructs callers to distinguish failures by matching Chinese msg substrings such as 找不到任务, 状态, and 积分. This effectively imposes a specific language expectation in client behavior, and the document does not offer a language/locale choice or a locale-agnostic alternative despite presenting this as recommended handling.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import requests
resp = requests.post(url, headers=headers, json=payload)
if resp.status_code == 400:
err = resp.json().get("detail", {})
msg = err.get("msg", "")
The client sends bearer credentials and task/review-related data to a third-party API endpoint with no user-facing disclosure, consent gate, or data minimization controls. In an agent/skill environment, this can lead to unintended exfiltration of sensitive product URLs, review datasets, task metadata, and API secrets to external infrastructure the user may not realize is being contacted.
This POST call transmits arbitrary task inputs and an Authorization bearer token to an external service. In the context of an agent skill, any external transmission is security-relevant because user-supplied review targets, comments, and metadata may be sensitive, and the code does not provide consent prompts, destination restrictions beyond the constant base URL, or auditing of transmitted content.
}
try:
response = requests.post(url, json=data or {}, headers=headers, timeout=30)
response.raise_for_status()
result = response.json()
if result.get("code") != 0:
The manifest describes an Amazon product review intelligence tool focused on fetching reviews, analyzing negative feedback, trends, and incremental updates. This file also supports checking external device status, retrieving browser extension download links, and querying account points, which are service-management capabilities rather than review-analysis functionality.
The manifest emphasizes fetching reviews, analysis, quantification, hidden-feedback discovery, suggestions, trends, and incremental updates. In addition to expected task creation and incremental refresh, this client can rename tasks and manually trigger analysis, which are remote state-changing management actions not stated in the manifest description.
The manifest describes capabilities around fetching reviews, analyzing negative feedback, trends, and incremental updates. rename_task is a separate remote-management capability that changes server-side task metadata and is not reflected in the stated core capabilities.
The manifest focuses on intelligence analysis functions such as negative-review analysis, issue quantification, hidden feedback discovery, suggestions, and trends. get_comments and get_comments_overview expand the scope to raw data access, which is broader than the explicitly described insight-oriented behavior.
The dependency is specified as requests>=2.28.0, which allows installation of any newer version without guaranteeing reproducibility or excluding known-bad releases. In a security-sensitive skill that fetches external Amazon review data, unpinned dependencies increase supply-chain risk and make it harder to verify whether deployed environments are using a safe version.
requests>=2.28.0
Because the manifest does not pin the requests version, it is impossible to determine whether installation will resolve to a release affected by known advisories. This is more concerning in this skill's context because it performs network requests to external services, so flaws in HTTP handling, redirect processing, TLS behavior, or credential loading could directly affect confidentiality or request integrity.
The code accesses CUSTOMER_INSIGHTS_API_KEY from the environment and uses it for authenticated API calls. While this is documented for developers in help text and docstrings, there is no explicit user-facing warning that the skill will read a credential from the environment and use it to contact an external service.
No suspicious patterns detected.