Security audit

astrmap-voc

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AstrMap VOC/API client for Amazon review collection and analysis, with no artifact-backed evidence of deception or malicious behavior.

Install only if you are comfortable sending your AstrMap API key and requested Amazon review task data to api.astrmap.com. Use a read-only or limited API key when you only need to view existing results, avoid using a primary Amazon seller account with the separate desktop client, and prefer an environment with an up-to-date pinned requests package.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly relies on environment secrets and outbound network access, yet it does not declare explicit permissions for those capabilities in the skill metadata. That weakens transparency and permission gating, making it easier for a user or host system to underestimate the skill's access to API keys and remote services. In this context, the risk is elevated because the workflow explicitly asks for an API key and sends it to an external service.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 83% confidence
Finding: The declared description focuses on VOC/review analysis, but the documented behavior also includes device-status checks, download-link retrieval, task renaming, and balance queries. This mismatch can mislead users about the operational scope of the skill and obscure side effects such as interacting with a desktop client ecosystem and account-management functions. While not inherently malicious, hidden or under-described capabilities reduce informed consent and make abuse or surprise actions more likely.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill exposes device-status checking and desktop-client download-link retrieval in addition to its stated VOC review-insight purpose. This scope expansion is risky because it gives an agent extra operational capabilities unrelated to the advertised function, increasing the chance of unexpected user impact or abuse.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The skill provides account points balance retrieval even though that capability is not part of the stated customer-insight workflow. While lower impact than task mutation, it still broadens access to account information beyond user expectations and violates least-privilege design.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Checking endpoint/device online status is not necessary for analyzing e-commerce reviews and introduces a capability to query the state of a user-associated endpoint. That can expose operational metadata and enable unintended monitoring outside the declared skill purpose.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: Retrieving desktop client download links is unrelated to VOC analysis and expands the skill into software distribution or installation assistance. In agent contexts, unrelated capabilities increase attack surface and can be chained with social-engineering or unwanted workflow changes.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: Account points retrieval is an account-management feature unrelated to the core review-analysis purpose. Even if read-only, it exposes extra account metadata and weakens the principle of least privilege for the skill.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 97% confidence
Finding: requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High

Category: Supply Chain
Confidence: 84% confidence
Finding: requests==2.28.0

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.