Security audit

amazon-review-insights

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AstrMap API wrapper for Amazon review collection and analysis, with meaningful third-party account risks that are described rather than hidden.

Before installing, understand that analysis and task management use an AstrMap API key, and review collection may require installing AstrMap's desktop client and logging it into an Amazon buyer account. Use a dedicated buyer account, verify desktop downloads and checksums, avoid sharing the API key, and confirm point-deducting actions before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly relies on environment variables and external network access, but those capabilities are not declared as permissions in a machine-readable way. That creates a transparency and policy-enforcement gap: operators and users may not realize the skill can read secrets and transmit them to a third-party API, increasing the risk of unintended credential exposure or unauthorized outbound access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 82% confidence
Finding: The declared description frames the skill as review analysis, but the documented behavior also includes device-state inspection, download-link retrieval, points/account checks, and broader task-management actions. This mismatch is dangerous because it weakens informed consent and makes it easier to smuggle extra operational or account-related capabilities under a narrower-sounding label.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation expands the operational scope from a review-analysis skill to a workflow that requires a separate desktop client to log into an Amazon buyer account and collect data. This creates an additional trust boundary and credential-exposure risk that is not apparent from the skill metadata, so users may install or use the skill without understanding that an external application will access an Amazon account.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: The guide states that the skill does not directly access Amazon, but also says that using the overall solution involves a desktop client that logs into Amazon to read review data. This distinction is technically narrow but security-relevant, because it can mislead users about the real data-access model and reduce informed consent around account use and associated risk.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The recommended client logic instructs callers to branch on free-form error-message substrings, including Chinese text, because all failures collapse to HTTP 400 with code -1. This creates brittle security handling where authorization, task-not-found, invalid-state, and other conditions can be misclassified if messages change, are translated, or are ambiguously matched, potentially causing unsafe fallback behavior or incorrect access-control decisions in downstream agents.

Natural-Language Policy Violations

Medium

Confidence: 76% confidence
Finding: By documenting Chinese-only message values as the practical matching surface for error handling, the API contract normalizes reliance on unstable human-readable text for control flow. In security-relevant workflows, this can lead to incorrect retry, authorization, or task-handling logic when message wording varies, enabling logic flaws, denial of service through error-looping, or accidental disclosure via improper fallback processing.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only, which allows installs to resolve to many different future versions and reduces reproducibility of builds. This can unintentionally introduce breaking changes or newly introduced vulnerable versions into the skill environment, making supply-chain risk harder to control.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.